AnyTool
Your files never leave your device. All processing happens locally in your browser.

How do I analyze an email header to see where an email came from?

Paste the raw email header (or drop an .eml file) into AnyTool. It parses the Received hop chain bottom to top, computes per-hop delays, extracts the originating IP, and shows SPF, DKIM, DMARC, and spam-score results. Everything runs in your browser — the header is never uploaded.

  • Received hop chain with per-hop delivery delays and total transit time
  • SPF / DKIM / DMARC / ARC verdicts with plain-English explanations
  • Originating IP, sender identity, and spoof/tamper risk flags
  • Spam score (X-Spam, SpamAssassin) and Microsoft 365 SCL/BCL/PCL decoding
  • 100% in-browser — paste or .eml drop, no upload, works offline

What is

Email Header

An email header is the metadata block at the top of every email that records the path it took (Received lines), sender and recipient addresses, subject, and authentication results such as SPF, DKIM, and DMARC. Analyzing it reveals the true origin and whether the message is spoofed.

Developer Tools

Related terms

Received HeaderSPFDKIMDMARCEmail Spoofing

Frequently Asked Questions

Yes — it is free with no signup, and your header is analyzed entirely in your browser.

The tool is completely free with no account required. Parsing of the raw header and .eml files happens locally in your browser with no server upload, so sensitive routing and address data never leaves your device, and it works offline after first load.

Yes — it surfaces SPF/DKIM/DMARC failures plus spoof and timestamp-tamper signals.

It reads the Authentication-Results, Received-SPF, and DKIM-Signature data to show pass/fail verdicts, flags non-monotonic Received timestamps and impossible gaps (classic forged-header signs), and checks display-name vs from-domain mismatches to help spot spoofing and phishing.

Paste the raw header text or drop a full .eml/.msg file — both work.

You can paste the raw header copied from Gmail, Outlook, Yahoo, or any client, or drag and drop a saved .eml/.msg file. The tool unfolds wrapped header lines, parses every key/value, and renders the hop timeline, auth badges, and spam score automatically.

Detailed Explanation

Methodology

How the Email Header Analyzer Works

AnyTool parses raw email headers (or a dropped .eml/.msg file) entirely in the browser. It unfolds RFC 5322 continuation lines, reads the Received chain bottom to top, normalizes each hop timestamp to UTC to compute per-hop delays and total transit time, and extracts SPF/DKIM/DMARC/ARC verdicts from Authentication-Results, Received-SPF, and DKIM-Signature. It also decodes spam scores (X-Spam-Status, SpamAssassin) and Microsoft 365 SCL/BCL/PCL codes from a bundled static lookup.

  • Received hop chain with per-hop delays and timezone normalization
  • SPF / DKIM / DMARC / ARC verdicts with explanations
  • Originating IP and sender identity extraction
  • Spam score plus Microsoft 365 SCL/BCL/PCL decoding
  • Spoof and timestamp-tamper risk flags
Privacy & Security

Privacy and Offline Use

All raw-header and .eml parsing runs client-side with no server, no upload, and no runtime CDN, so sensitive routing and address data never leaves the device and the tool works offline after first load. Any optional IP geolocation is user-initiated and clearly labeled; reserved and private IPs are flagged and never sent anywhere.

Email Header Analyzer: AnyTool vs typical tools
CapabilityAnyToolTypical tools
Processing locationIn-browserOften server-side
Delay timelineYesSometimes
SPF/DKIM/DMARC + ARCYesPartial
Spam score / M365 codesYesRare
.eml drop + offlineYesRare

Capabilities reflect the live AnyTool tool; competitor behavior varies by service.