Paste the raw headers of an email and get a readable summary: who it claims to be from, where it was really sent from, the path it took through each server with the delay between hops, and whether it passed the SPF, DKIM and DMARC sender checks. Mismatches between the From, Return-Path and Reply-To addresses are flagged. It reads only the text you paste, and it does not look anything up on the internet.
Every mail server that handles a message adds a Received line on top of the pile, with its own name, the name and address of the server it got the message from, and a timestamp. Read from the bottom, those lines are a travel log. They show the first server that accepted the message, every relay and the final delivery.
Other headers describe the sender. The From line is what you see in the inbox, the Return-Path is where bounces go and the Reply-To is where your answer goes. They are three separate fields, and a genuine message can use different ones. A forged message often relies on you reading only the first.
When mail from your own domain goes to spam, the authentication results are the first place to look. A pass on SPF, DKIM and DMARC means the receiving server accepted the message as genuinely yours. A fail or a missing result usually means a sending service has not been added to your DNS records yet.
Delays tell a different story. A message that arrives minutes late has usually waited at one hop, and the timestamps show which one. If that hop belongs to your own provider, you can raise it with them with evidence in hand. If it belongs to the recipient's side, there is little you can do but know where it happened.
No. It reads only the headers you paste and makes no lookups. The SPF, DKIM and DMARC results come from the Authentication-Results line that the receiving server wrote when the message arrived, so the tool reports what that server decided at the time.
SPF checks that the server that sent the message is allowed to send for the domain in the Return-Path. DKIM checks a digital signature that proves the message was not changed and was signed by the domain. DMARC ties them together: it asks whether the From domain matches the domain that passed SPF or DKIM and tells receivers what to do if not.
Newsletter and billing services often send on your behalf using their own Return-Path, so a difference can be normal. It becomes a problem when the domains are unrelated and DMARC also fails, which is the pattern of a forged message. Subdomains of the same domain count as a match.
Each Received line ends with a date. The tool puts the hops in the order the message travelled and subtracts one time from the next. If a server's clock is wrong, the difference can come out negative, and the tool flags that.
In Gmail, open the message, choose the three dots and 'Show original'. In Outlook, open the message properties and look for the internet headers. In Apple Mail, use View, Message, All Headers. Copy everything above the first blank line.
Related: DNS lookup, Email signature generator, Website grader.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.