Email Header Analyzer – Complete Guide to Reading Received Headers and Authentication Results

A message arrived hours late, landed in spam, or looks like a phishing attempt from your own CEO. The answers are in the headers that every server along the way added: where the message came from, which servers relayed it, how long each step took, and whether SPF, DKIM and DMARC passed when it arrived. Raw headers, though, are long, folded and written newest first, which makes them tedious to read by eye.

The Email Header Analyzer takes pasted raw headers and rebuilds the delivery route in order, computes the delay between hops, extracts the authentication results and DKIM signatures, and shows the key message fields. It runs entirely in your browser; nothing you paste leaves your computer. Use it for delivery delays, spam-folder investigations, phishing triage and to find the DKIM selector of a domain.

What is an email header analyzer?

In simple terms

Every email carries a block of header lines above the message text, like stamps and notes on an envelope. Each mail server that handles the message adds a "Received" stamp with its name and the time. The receiving server also writes down whether the sender passed authentication checks. An analyzer reads these stamps, puts them in order and turns them into a readable route and verdict.

Technical background

The relevant standards are:

• RFC 5322 (Internet Message Format): header fields are Name: value lines. Long values are folded onto continuation lines that start with a space or tab; unfolding joins them back together. The headers end at the first empty line.
• RFC 5321 section 4.4: each SMTP server prepends a Received: trace field, typically from <host> (<details>) by <host> with <protocol> id <id>; <date>. The newest is on top.
• RFC 8601: Authentication-Results: records results such as spf=pass, dkim=pass and dmarc=pass, prefixed by the authserv-id of the server that evaluated them.
• RFC 6376: the DKIM-Signature: header carries d= (domain), s= (selector) and a= (algorithm).
• RFC 8617 (ARC): arc= results show authentication preserved across intermediaries such as mailing lists.
• RFC 2047: non-ASCII text in headers like Subject is written as encoded words (=?UTF-8?Q?…?=).

Command-line equivalent for a saved message: grep -iE '^(received|authentication-results|dkim-signature):' message.eml, which still leaves unfolding and ordering to you.

Why use an email header analyzer?

• Delivery delays: see which hop added the delay, for example a queue at an outbound relay or greylisting at the receiver.
• Spam-folder placement: check whether SPF, DKIM or DMARC failed at your provider.
• Phishing triage: compare the From domain with the authenticated domains and the first external hop.
• Find the DKIM selector and signing domain for a DKIM lookup.
• Verify a new sending setup: send a test message to an outside mailbox and read how it was evaluated.
• Check List-Unsubscribe: the analyzer shows List-Unsubscribe and List-Unsubscribe-Post, which bulk-sender requirements care about.

Who should use it?

• Mail administrators and help-desk staff investigating delivery and spam complaints.
• Security analysts and SOC teams triaging suspected phishing.
• Developers and marketers testing transactional or bulk mail setups.
• Anyone asked by support to "check the headers".

How email header analysis works

The NetTools.tech Email Header Analyzer performs every step in your browser, with no server request:

1. Input check. Empty input and input larger than 256 KB are refused.
2. Header extraction. Line endings are normalized, leading blank lines and an mbox From separator line are skipped, and everything after the first blank line is discarded as body (with a warning if it contained text).
3. Unfolding. Continuation lines starting with a space or tab are joined to the previous field.
4. Route. All Received: fields are reversed (oldest first). For each, the analyzer extracts from (with the parenthesized details such as the IP), by, with (protocol) and the date after the last semicolon.
5. Delays. The time difference to the previous hop is computed in seconds, and the total transit time from the first to the last dated hop. Negative delays trigger a clock warning.
6. Authentication. Every Authentication-Results: field is scanned for spf=, dkim=, dmarc= and arc= results, with the comment in parentheses and the authserv-id of the reporting server.
7. DKIM signatures. For each DKIM-Signature:, the d=, s= and a= tags are shown.
8. Message details. From, To, Cc, Subject, Date, Message-ID, Return-Path, Reply-To, List-Unsubscribe and List-Unsubscribe-Post are shown, with RFC 2047 encoded words decoded.

The analyzer does not query DNS, does not verify signatures and does not look up IP addresses. It reports what the headers say.

How to use the NetTools.tech Email Header Analyzer

1. Get the raw headers: Gmail "Show original", Outlook "View message source" (or File, Properties), Apple Mail View, Message, All Headers.
2. Open Email Header Analyzer.
3. Paste the headers into Raw headers.
4. Press Analyze headers. Use Try a sample to see the output with an illustrative message, and Clear to empty the form.
5. Read the panels: warnings, Authentication, Delivery route, Message details, DKIM signatures, and the collapsible list of all header fields.

Understanding the results

Example: a two-hop message

Click Try a sample to load an illustrative message built from documentation values. It contains two Received headers, one Authentication-Results header and one DKIM-Signature:

Received: from mx.example.net (mx.example.net [192.0.2.25])
    by inbound.example.org with ESMTPS id 4Xk2abc123
    for <[email protected]>; Tue, 6 Oct 2026 10:00:07 +0000
Received: from client.example.com (client.example.com [198.51.100.7])
    by mx.example.net with ESMTPSA id 7Hq9def456; Tue, 6 Oct 2026 10:00:02 +0000
Authentication-Results: inbound.example.org;
    spf=pass (inbound.example.org: domain of [email protected] designates 192.0.2.25 as permitted sender) [email protected];
    dkim=pass header.d=example.com header.s=sel2026;
    dmarc=pass (p=REJECT) header.from=example.com

The analyzer shows:

• Authentication: SPF pass, DKIM pass, DMARC pass (with the comment p=REJECT), each "Reported by inbound.example.org".
• Delivery route · 2 hops · total 5 s: hop 1 from client.example.com (client.example.com [198.51.100.7]) by mx.example.net with ESMTPSA at 2026-10-06 10:00:02; hop 2 from mx.example.net (…[192.0.2.25]) by inbound.example.org with ESMTPS at 10:00:07, delay 5 s.
• Message details: the decoded Subject "Quarterly report — draft", From, To, Date, Message-ID and List-Unsubscribe.
• DKIM signatures: d=example.com s=sel2026 a=rsa-sha256.

Reading it: the user authenticated to their provider (ESMTPSA), the provider relayed it over TLS (ESMTPS) to the recipient's server, which recorded passing SPF, DKIM and DMARC. With s=sel2026 and d=example.com you can check the key in the DKIM Lookup.

Common use cases

• Explaining "the email took two hours": find the hop with the large delay.
• Proving that a spoofed message did not come from your infrastructure.
• Checking whether a forwarding rule broke SPF while DKIM still passed.
• Collecting the sending IP of a message to check it with Email Blacklist Check or Reverse DNS.
• Confirming that mail from a new SaaS sender is DKIM-signed with your domain.

Troubleshooting

"No header fields were recognized"

You probably pasted the rendered message or only the body. Use the client's "show original" or "view source" function and copy the raw text from the very first line.

"No Authentication-Results header found"

Some mail systems do not add it, or you copied headers from the sender's Sent folder, where no receiver evaluation has happened. Send the message to an external mailbox and analyze it there.

Delays look wrong or negative

Server clocks differ or a hop wrote its date in a nonstandard format that cannot be parsed (shown as "—"). Treat timings as approximate and look for large, consistent gaps instead.

The route shows fewer hops than expected

Some providers strip internal Received headers, and some hops write headers without from or by parts. The analyzer shows what is present; missing fields appear as "—".

Common mistakes

• Trusting the bottom Received header or an Authentication-Results header that your provider did not add.
• Pasting forwarded copies: forwarding as an attachment preserves headers, forwarding inline does not.
• Assuming dkim=pass means DMARC passes: the DKIM d= domain must align with From.
• Reading delays without considering time zones; the analyzer converts all times to UTC.
• Pasting full messages with attachments, which can exceed the 256 KB limit.

Limitations

• The analyzer reports what headers claim. Any header below your provider's first one can be forged.
• It does not verify DKIM signatures, evaluate SPF or query DNS; it relies on the receiving server's Authentication-Results.
• Received headers are parsed with a general pattern; unusual formats may leave fields empty.
• Only the listed summary fields are decoded and shown in Message details; all fields remain available in the full list.
• Date parsing depends on the browser; nonstandard dates show as unknown.

Security & privacy

The analysis runs entirely in your browser. The pasted text is not uploaded to NetTools.tech, not sent to any third party, and not stored; it disappears when you clear the form or close the page. Headers can still contain personal data (names, addresses, internal host names, IP addresses), so be careful where else you share them. If a message body is accidentally included, it is discarded before analysis. No credentials are ever needed.

Related tools

• DKIM Lookup – check the key for the selector found in the headers (guide).
• SPF Lookup – see why SPF passed or failed for the envelope domain (guide).
• DMARC Lookup – read the policy that applied to the message (guide).
• Reverse DNS Lookup – check the PTR record of a sending IP (guide).
• IP Lookup – see the network and owner of a hop's IP address (guide).
• Email Tools overview – which email tool fits which question.

Summary

Email headers record where a message travelled, how long each step took and how the receiver judged its authentication. The NetTools.tech Email Header Analyzer unfolds and orders them, computes delays, and extracts authentication results, DKIM signatures and key fields, all locally in your browser. Remember that only headers added by servers you trust are reliable evidence.