Paste raw email headers to trace the delivery path, check authentication results, and measure hop-by-hop timing.
Paste raw email headers above, then click Analyze
Every email contains a set of headers - structured metadata that mail servers add as the message travels from sender to recipient. Headers record every server the message passed through, when it arrived at each hop, what authentication checks were performed, and dozens of other details. Most email clients hide headers by default; you can usually view them via "Show original", "View source", or "Message source" in your client's menu.
The Received: headers form the delivery chain. Each mail server that handles a message prepends a Received: header recording where the message came from, which server received it, the protocol used, and a timestamp. Reading them from bottom to top gives the chronological path - this tool reverses them for you. Unexpected hops or long delays can indicate routing issues, greylisting, or spam-filtering queues.
SPF: confirms the sending server's IP is authorised by the domain's DNS record. A pass means the IP is on the allowlist.
DKIM: a cryptographic signature over the message content. A pass means the message was not modified in transit.
DMARC: policy layer on top of SPF and DKIM. A pass means at least one mechanism aligned with the From domain per the domain's DMARC policy.
Delays of a few seconds per hop are normal - servers verify the message before accepting it. Delays of minutes usually indicate greylisting (a spam-filtering technique that temporarily rejects unknown senders). Delays of hours mean the sending server lost connectivity and retried delivery. Negative delays reflect clock skew between MTAs and are harmless.