Paste the raw headers and get the full delivery path, how long each hop took, and the SPF, DKIM and DMARC results. Everything runs in your browser — nothing is uploaded.
Gmail: open the message, click the three dots, choose Show original, then copy everything.
Outlook: open the message, File → Properties, copy the box marked Internet headers.
Apple Mail: View → Message → All Headers.
Or just paste a whole .eml file — the headers get picked out automatically.
Every mail server that touches a message adds a Received line at the top, so the raw list runs newest to oldest. This flips it, so hop 1 is where the message started. Large gaps between hops usually mean greylisting, a queue backup, or a server under load.
Be careful drawing conclusions from the earliest hops. A sender can forge Received lines before the message reaches a server you trust — only the hops added by your own provider and the ones after it are reliable.
SPF checks whether the sending server was authorised by the domain's DNS. DKIM checks a cryptographic signature, proving the message wasn't altered in transit. DMARC ties those to the visible From address and tells receivers what to do on failure.
All three passing does not mean an email is honest — a scammer can authenticate their own domain perfectly. It means the message really came from the domain it claims. Whether that domain deserves trust is a separate question.
In Gmail, open the message, click the three dots and choose Show original. In Outlook, open the message and go to File then Properties, and copy the Internet headers box. In Apple Mail, use View then Message then All Headers. You can also paste a whole .eml file here.
Each mail server that handles a message adds a Received line, so the raw list runs newest to oldest. This page flips it so hop one is where the message started, and shows the delay at each step. Large gaps usually mean greylisting or a queue backup rather than anything sinister.
SPF checks whether the sending server was authorised by the domain. DKIM verifies a cryptographic signature, proving the message wasn't altered in transit. DMARC ties both to the visible From address. Together they prove the message came from the domain it claims — not that the domain deserves trust.
Often, yes. A DMARC failure, or a From domain that doesn't match the Return-Path, are the classic signals and both are flagged here. Be careful with the earliest hops, though: a sender can forge Received lines before the message reaches a server you trust.
No. Headers are parsed in your browser and never transmitted.