Paste the raw email headers to analyze for security indicators
Need Professional Security Testing?
Our penetration testers find vulnerabilities before attackers do. Get a comprehensive security assessment.
What Is Email Header Analysis
Email headers are metadata lines embedded in every email message that trace the message's path from sender to recipient. Headers contain critical information including the originating server, authentication results, routing hops, timestamps, and security verification outcomes. Analyzing email headers is a fundamental skill for investigating phishing attacks, diagnosing delivery issues, and verifying email authenticity.
While the visible "From" address can be easily spoofed, the headers reveal the true origin of a message. Security teams, IT administrators, and forensic analysts rely on header analysis to distinguish legitimate emails from malicious ones.
How Email Headers Work
Email headers are added by each mail server that processes the message. They are read from bottom to top — the oldest headers appear at the bottom, and each server that handles the message prepends new headers at the top.
Key Header Fields
| Header | Purpose | Security Relevance |
|---|---|---|
| Received | Records each server hop | Trace the actual delivery path; detect forged routing |
| From | Display sender address | Easily spoofed — do not trust without authentication |
| Return-Path | Bounce address (envelope sender) | Should match the From domain; mismatches suggest spoofing |
| Authentication-Results | SPF, DKIM, DMARC verdicts | Definitive authentication status from the receiving server |
| DKIM-Signature | Cryptographic signature | Proves the message was not altered in transit |
| Received-SPF | SPF check result | Confirms the sending IP is authorized for the domain |
| X-Mailer / User-Agent | Sending software | Can reveal phishing tools or unusual sending software |
| Message-ID | Unique message identifier | Should contain the sender's domain; mismatches are suspicious |
| X-Originating-IP | Original sender IP | Reveals the actual source, even behind forwarding services |
Common Use Cases
- Phishing investigation: Determine whether a suspicious email actually originated from the claimed sender by examining Received headers and authentication results
- Delivery troubleshooting: Trace why emails are being delayed, rejected, or sent to spam by following the routing path and reading server responses
- SPF/DKIM/DMARC verification: Confirm that email authentication is working correctly by checking Authentication-Results headers
- Forensic analysis: During incident response, extract IP addresses, timestamps, and server identities from headers to build an attack timeline
- Spam source identification: Identify the originating server and network for spam campaigns to feed into blocklists and abuse reports
Best Practices
- Read headers bottom-to-top — The first Received header (at the bottom) is the most trustworthy because it was added by the first server to handle the message. Upper headers can be forged by the sender.
- Verify authentication results — Look for the Authentication-Results header added by your receiving mail server. SPF=pass, DKIM=pass, and DMARC=pass together provide strong assurance of legitimacy.
- Check for header inconsistencies — Mismatches between the From domain, Return-Path, DKIM signing domain, and originating IP are strong indicators of spoofing.
- Extract IOCs for threat intelligence — IP addresses, domains, and Message-IDs from malicious email headers are valuable indicators of compromise (IOCs) for blocklists and SIEM correlation.
- Use automated tools for bulk analysis — Manual header analysis is valuable for individual investigations, but use automated tools and mail gateway logs for analyzing patterns across many messages.
References & Citations
- IETF. (2014). RFC 7208: Sender Policy Framework (SPF). Retrieved from https://datatracker.ietf.org/doc/html/rfc7208 (accessed January 2025)
- IETF. (2011). RFC 6376: DomainKeys Identified Mail (DKIM). Retrieved from https://datatracker.ietf.org/doc/html/rfc6376 (accessed January 2025)
- IETF. (2015). RFC 7489: Domain-based Message Authentication (DMARC). Retrieved from https://datatracker.ietf.org/doc/html/rfc7489 (accessed January 2025)
- FBI IC3. (2023). Business Email Compromise: The $50 Billion Scam. Retrieved from https://www.ic3.gov/PSA/2023/psa230609 (accessed January 2025)
Note: These citations are provided for informational and educational purposes. Always verify information with the original sources and consult with qualified professionals for specific advice related to your situation.
Key Security Terms
Understand the essential concepts behind this tool
SPF (Sender Policy Framework)
Email authentication method that specifies which mail servers are authorized to send email on behalf of your domain.
DKIM (DomainKeys Identified Mail)
Email authentication method that uses cryptographic signatures to verify that email content has not been tampered with in transit.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
Email validation system that builds on SPF and DKIM to prevent email spoofing and provide reporting on email authentication failures.
Phishing
A social engineering attack that uses fraudulent communications to trick recipients into revealing sensitive information or installing malware.
Frequently Asked Questions
Common questions about the Email Header Analyzer
Email headers contain metadata about email's journey from sender to recipient: Key header fields: (1) From: Display name and address (easily spoofed!), what user sees in mail client, not authenticated by default. (2) Return-Path: Where bounces go, indicates sending server, often different from "From" in phishing. (3) Received: Chain of mail servers that handled message, timestamped hops from sender to recipient, most reliable for tracing origin. (4) Authentication-Results: SPF/DKIM/DMARC check results, pass/fail for each mechanism, critical for detecting spoofing. (5) Message-ID: Unique identifier for email, format reveals sending system. (6) X-Originating-IP: Original sender's IP address, useful for geolocation and reputation checks. Security value: (1) Detect spoofing - "From" says CEO but Return-Path is suspicious external domain, authentication failures indicate forged sender. (2) Trace origin - Follow "Received" headers backwards to source, identify compromised mail servers, geolocate attacker infrastructure. (3) Identify phishing patterns - Free email services for business emails, mismatched domains, suspicious routing through unexpected countries. (4) Forensic analysis - Incident response investigations, evidence collection, attribution. (5) Validate legitimacy - Verify email came from claimed sender, check authentication pass rates. What attackers manipulate: Display name in "From" (easy), actual "From" address (harder, caught by DMARC), can't manipulate "Received" chain (added by infrastructure), can't forge DKIM signatures without private key. Use cases: Investigate suspicious emails before clicking links, verify wire transfer requests (CEO fraud), analyze phishing campaigns, compliance audits (email retention), troubleshoot delivery issues.
⚠️ Security Notice
This tool is provided for educational and authorized security testing purposes only. Always ensure you have proper authorization before testing any systems or networks you do not own. Unauthorized access or security testing may be illegal in your jurisdiction. All processing happens client-side in your browser - no data is sent to our servers.