Email tool

Email Header Analyzer

Decode raw email headers to trace the delivery path and authentication results.

In Gmail use Show original; in Outlook use File → Properties → Internet headers. Everything stays in your browser.

Frequently asked questions

How do I find the raw headers in my email client?

In Gmail: open the message, click the three-dot menu (More), and select Show original — then copy everything above the blank line that separates headers from the body. In Outlook: open the message, go to File > Properties, and copy the Internet headers field. In Apple Mail: open the message and choose View > Message > All Headers.

What does a failed SPF or DKIM result in the headers mean?

A failed authentication result does not guarantee the email is malicious, but it is a significant indicator. Legitimate email from your own domain should always pass SPF and DKIM. Failures on inbound mail from external senders may indicate spoofing, forwarding misconfiguration, or a sending server not listed in the sender's SPF record. Combine header analysis with context — sender reputation, content, and urgency — when evaluating suspicious messages.

Want this handled for you?

Elevate manages IT & security for regulated Los Angeles firms.

Book a strategy call