Email Header Analyser

What's in an email header and why it matters

Two parts to every email. The bit you read, and the bit nobody shows you. Headers are metadata lines appended by every server that touches the message on its way in. A normal email might pass through three or four systems. A badly routed one hits ten. Every single hop leaves a record. That record is the raw header.

Email clients bury it because it's not readable - dense, hundreds of lines sometimes, format barely touched since the early 1980s. But when something breaks - message hits spam, takes hours, someone sends you a phish with your own domain on it - that's where the explanation is.

What gets analysed

Drop in the raw header text and you get five sections.

• Sending path - the Received chain in order, oldest first. Which server handed the message to which, the timestamp, and the gap between hops in seconds. Anything over 30 seconds gets flagged.
• Auth results - the Authentication-Results header unpacked: SPF, DKIM and DMARC each get their result - pass, fail or none - plus the signing domain. Colour coded.
• Spam assessment - if the server ran SpamAssassin or similar, you get the score, whether the flag was set, and the triggered rules. The rules are the useful bit - that's what the server actually objected to.
• Key headers - From, Reply-To, Return-Path, Message-ID, Date and Subject in a table. Reply-To on a different domain to From gets flagged.
• Anomalies - mismatched reply domains, high spam scores, slow relays, flag set to yes - pulled to the top rather than buried.

Nothing leaves your browser. The analysis runs locally in JavaScript.

Pulling the raw headers from your email client

Gmail - open the email, three-dot menu at the top of the message pane, Show original, Copy to clipboard.

Outlook desktop - open the email, File then Properties. Internet headers at the bottom of the dialog.

Apple Mail - View, Message, All Headers. Select all, copy.

Diagnosing the problem

Spam folder but auth was clean? Go to the spam section. The triggered rules are usually specific enough to point you at the problem - a phrase, a link, a header value that looked wrong.

Delayed delivery? The hop timeline shows exactly where it sat. A minute or two at one relay is greylisting - normal, the server just needed a retry. Hours at a single point means a queue problem or connectivity issue there.

Reply-To doesn't match From? Could be a marketing platform, could be a forged header. Legitimate either way - but worth knowing when you're investigating something suspicious.