Paste raw email headers to inspect routing, SPF/DKIM/DMARC results, originating IP, and delivery hops. All processing is local.
Extracts routing path, authentication results (SPF, DKIM, DMARC), originating IP, and delivery timing. All processing is local. Nothing is transmitted.
Parses raw email headers and extracts the delivery path (Received chain), authentication results (SPF, DKIM, DMARC), originating IP, sending mail server, and timestamps. Displays the full hop-by-hop routing from sender to recipient.
Paste the full header block from any email client — most clients have a "View source" or "Show original" option that exposes the raw headers.
Email headers are the primary forensic artifact for phishing investigation. They reveal whether SPF, DKIM, and DMARC checks passed or failed, the true originating IP of the sender, whether the display name matches the actual sending domain, and how many hops the message took to arrive.
A phishing email that appears to come from your CEO may pass DMARC if the attacker controls a lookalike domain with its own SPF and DKIM setup. Headers let you trace exactly where the message originated.