Paste a raw email header to trace its Received hops, read the SPF, DKIM and DMARC results, and find the originating IP. Free, and it runs entirely in your browser.
Paste the full email header
How to get the raw header: in Gmail, open the message, click the three-dot menu and choose Show original. In Outlook, open the message and go to File > Properties (or … > View > View message source on the web). In Apple Mail, select the message and choose View > Message > Raw Source. Copy everything and paste it above.
Reads Received hops and SPF, DKIM & DMARC results straight from a pasted email header, entirely in your browser. Nothing is uploaded.
Open the raw header
Use Show original in Gmail, message source in Outlook, or Raw Source in Apple Mail.
Paste it in
Copy the whole header block and paste it into the box above.
Analyze
The tool unfolds the header, traces every Received hop and reads the auth results.
Read the trace
See the origin, the SPF, DKIM and DMARC verdicts, and each hop's delay.
Every email carries a hidden header that records its full journey, each mail server it passed through, the time it arrived, and the authentication checks that ran along the way. Reading it by hand is awkward because the Received lines are folded across multiple lines and listed in reverse order.
This email header analyzer does the reading for you. Paste a raw header and it unfolds the lines, orders the Received hops from origin to delivery, extracts the originating IP, and lays out the From, To, Subject, Date and Message-ID so you can see at a glance who sent a message and how it reached you.
The header also tells you whether a message was authenticated. The analyzer pulls the SPF, DKIM and DMARC verdicts out of the Authentication-Results line, shows them as colour-coded pass, fail or none chips, and names the signing and aligned domains, then sums it up in a plain-English verdict so you don't have to decode the raw syntax.
That makes it easy to spot a spoofed sender (a friendly From address whose DMARC fails) or to confirm that a real message authenticated cleanly. If the failures are on your own sending domain, the fix is in your DNS records rather than the header.
Email headers can contain sensitive routing details, internal server names and recipient addresses, so this tool never uploads them. The parsing is 100% client-side JavaScript, the header you paste is analyzed on your device and nothing is sent to, stored on, or logged by any server.
It's free, needs no signup, and works on any raw header from Gmail, Outlook, Apple Mail, or any other mail client.
The Received lines are the heart of an email trace, and the one rule to remember is that they stack newest on top, so you read them from the bottom up. Say a header holds two Received lines. The lower one reads from smtp.acme.com ([203.0.113.42]) by mx.google.com ... 09:14:59 -0700, and the line above it reads from mx.google.com by mail.yourcompany.com ... 09:15:07 -0700. Because the bottom line is the oldest, that is the origin: the message left smtp.acme.com on the IP 203.0.113.42. The line above is the hand-off to your own mail server eight seconds later. The analyzer flips that order for you, so hop 1 is always the origin and the final hop is the server that dropped the message in your inbox, no counting backwards required.
The Delay column shows the gap between each hop, and the total beside the heading is the time from origin to delivery. Most hops are sub-second; the tool highlights the single slowest one with a stopwatch, so a suspicious multi-minute gap (usually a message held in a queue, greylisted, or paused by a spam filter) is easy to spot. A long delay isn't proof of anything by itself, but it's the first place to look when someone says an email showed up late.
Headers are how you separate a genuine sender from a forgery, because the visible From address is trivially easy to fake while the routing and authentication data is not. Start with the DMARC verdict: a friendly, familiar From address (a bank, a supplier, a colleague) paired with a DMARC fail is the single strongest spoofing signal, because it means the domain you see never authorised the server that sent the message. Then compare the From domain against the Return-Path and the SPF mailfrom domain. On legitimate mail these usually belong to the same organisation; on a phishing message the Return-Path often points at a throwaway or unrelated domain.
Next, look at the origin. The earliest Received hop and the originating IP should be consistent with who the message claims to be, a supposed PayPal notice injected from a residential IP in an unexpected country, or a Reply-To that quietly differs from the From, are classic tells. You can run that originating IP through our free blacklist checker to see whether it already carries a spam reputation. No single red flag is conclusive, but a From/Return-Path mismatch plus a DMARC fail plus an unexpected originating network together are about as close to proof of spoofing as a header gets.
Before you can trace anything you need the raw source, which every desktop and web client can export even though the option is buried. In Gmail on the web, open the message, click the three-dot More menu beside Reply, and choose Show original. In new Outlook and Outlook on the web, open the message, click the three-dot menu, then View > View message source. In classic Outlook for Windows, double-click the message to open it in its own window, then File > Properties, and copy the Internet headers box. In Apple Mail, select the message and choose View > Message > Raw Source, or press Option-Command-U. In Yahoo Mail, open the message and use More > View raw message; in Proton Mail, open the message and pick View headers from the three-dot menu.
Two gotchas trip people up. First, the mobile Gmail and Outlook apps can't show the raw source at all. There is no Show original on the phone, so open the same message in a desktop browser when you need the header. Second, forwarding a message the normal way rewrites the headers with your own server's hops and drops the original sender's, so the trace you'd analyze becomes yours, not theirs. To keep the original intact, forward it as an attachment (Gmail's Forward as attachment, or in Outlook drag the message into a new email), which sends the untouched .eml file; the recipient opens that attachment and exports its raw source from there.
What is an email header?
An email header is the block of technical metadata that travels with every message above the body you normally read. It records the path the email took between mail servers (the Received lines), authentication results like SPF, DKIM and DMARC, and fields such as From, To, Subject, Date and Message-ID. Mail apps hide it by default, but it is the definitive record of how (and from where) a message actually reached you.
How do I get or view the full email header in Gmail, Outlook and Apple Mail?
In Gmail, open the message, click the three-dot menu at the top right and choose Show original, then copy everything on that page. In Outlook desktop, open the message and go to File > Properties and copy the Internet headers box; in Outlook on the web, open the message, choose the three-dot menu > View > View message source. In Apple Mail, select the message and choose View > Message > Raw Source. Paste whatever you copy into the box above.
How do I read the Received hops in an email header?
Each Received line is one hop the message made between servers, and they are written in reverse order, the bottom Received line is the origin (where the email started) and the top one is the server that finally delivered it to you. Read from the bottom up to follow the journey. This tool re-orders them for you, numbers each hop from the origin, and shows the delay between hops so you can spot where a message was slowed down.
What do SPF, DKIM and DMARC pass or fail mean in a header?
These are the three authentication checks the receiving server ran. SPF pass means the sending server was authorised to send for the envelope domain. DKIM pass means the message carried a valid cryptographic signature for the signing domain, so the content wasn't tampered with in transit. DMARC pass means the visible From domain aligns with the SPF or DKIM domain, tying it all together. A pass on all three is a strong sign the sender is genuine; a fail (especially on DMARC) is a common signal of spoofing or a misconfigured sender.
How do I find who really sent an email and the originating IP?
Look at the earliest (bottom) Received line. It usually contains a from clause with the sending server's name and a bracketed IP address, which is the originating IP. This analyzer pulls that IP out for you and highlights it in the summary. Combined with the Return-Path and the DKIM and SPF domains, the originating IP tells you which network actually injected the message, which is how you tell a legitimate sender from a spoofed From address.
Is my pasted header uploaded anywhere?
No. The entire analysis runs in your browser using JavaScript, the header you paste is never sent to a server, stored, or logged. You can confirm this by disconnecting from the internet after the page loads and running the tool; it still works, because nothing leaves your device.
Can I see the sender's real IP address if they used Gmail or Outlook?
Often not. When someone sends through Gmail or Microsoft 365 webmail, the earliest Received hop shows Google's or Microsoft's outbound server rather than the sender's home or office IP, because the big providers deliberately strip the client's originating IP for privacy. The originating IP this tool surfaces is real, but for major webmail it identifies the provider's infrastructure. You'll only see a true end-user IP when the message came from a desktop mail client or a smaller server that stamps it into the Received chain.
Can I find a sender's location from an email header?
Only roughly, and only sometimes. If the header exposes a genuine originating IP, you can run that IP through a geolocation service to get an approximate city or region and the network operator, but that is the location of the mail server, not the person, and it can be a data centre anywhere. When the message was sent through Gmail, Outlook or another large provider, the IP points at their servers and tells you nothing about where the sender physically is. Treat any location derived from a header as a weak clue, never an address.
Does an SPF or DKIM fail always mean an email is spoofed?
No, legitimate mail fails these checks all the time. Forwarding breaks SPF because the forwarding server isn't listed in the original domain's SPF record, and mailing lists often break DKIM by editing the subject or footer after the message was signed. That is exactly why DMARC exists: it passes as long as either SPF or DKIM passes and aligns with the visible From domain. Judge authenticity on the DMARC result and domain alignment rather than a lone SPF or DKIM fail.
What is the difference between the From address and the Return-Path?
The From is the visible sender your mail app displays; the Return-Path (also called the envelope sender or bounce address) is where the server sends delivery failures, and it is set during the SMTP transaction rather than typed by the person composing the message. On normal mail the two belong to the same organisation. A Return-Path on a completely unrelated domain from the From is a hallmark of spoofing and of some bulk senders, and it's one of the fields this analyzer pulls out for you so the mismatch is easy to see.
What does compauth mean in a Microsoft 365 email header?
Compauth, or composite authentication, is Microsoft's own combined verdict, added by Exchange Online Protection when a message lands in an Outlook or Microsoft 365 mailbox. It folds SPF, DKIM and DMARC together with Microsoft's implicit-authentication heuristics into a single pass, fail or none result, usually with a reason code. This tool shows a compauth chip whenever Microsoft included one, so you can see how Microsoft itself judged the message, not just the raw SPF, DKIM and DMARC lines.
Ready to 10x your pipeline?
Send your first cold email campaign today.
Start my free trialAddress: 151 Calle de San Francisco San Juan, Puerto Rico
Email: support@emailchaser.com
Product
Cold Email SoftwareAutopilotEmail FinderCampaignsSales CRMLead FinderEmail AccountsEmail WarmupEmail VerifierCold Email APIMCP ServerAPI documentationWho it's for
FreelancersFoundersSales teamsMarketing agenciesRecruitment agenciesLead generation agenciesComparisons
Best cold email softwareInstantly alternativesSmartlead alternativesInstantly vs EmailchaserSmartlead vs EmailchaserHunter vs EmailchaserFree tools
All free toolsBulk Email VerifierDeliverability TestEmail Header AnalyzerSMTP Settings FinderCold Email TemplatesBoolean Search BuilderAudience Size CalculatorName SplitterCompany Email FormatSpam Word CheckerInternational
Cold email (ES)Cold email (FR)Cold email (DE)Cold email (IT)Cold email (PT)Verifica email (IT)© Copyright 2026 Emailchaser