Email Header Analyzer

How to get the email headers

Copy everything from the top down to the first empty line, then paste it into the box above and press Analyze headers. You can paste the whole message too; the tool ignores the body.

What the analysis shows

• Sender IP: the first public address in the delivery chain, or the address in X-Originating-IP when the sender's provider includes it.
• SPF, DKIM and DMARC: whether the receiving server confirmed that the message really comes from the domain it claims. How these checks work.
• Delivery path: every server that handled the message, in order, with the time spent at each hop.
• Summary: From, To, Subject, Date, Message-ID, Return-Path and the mail program used.

Spotting phishing

Be suspicious when:

• SPF, DKIM or DMARC show fail.
• The From address and the Return-Path or Reply-To use different domains.
• The first hop comes from a country or network that does not match the claimed sender.
• The message claims to come from a bank or service but was sent from a residential IP.

Read how to read email headers for a step-by-step walkthrough.

Privacy

Headers are analyzed when you press the button and are not stored. They can contain email addresses, so do not share the results publicly.

Frequently asked questions

Can I find the real location of the sender?

Only sometimes. Webmail services like Gmail and Outlook.com usually hide the sender's own IP and show their servers instead, so the trace ends at the provider.

Why are the times in the delivery path out of order?

Each server writes its own clock time. A server with a wrong clock makes a hop look negative or very long. We never show negative delays.

What does "SPF softfail" mean?

The sending server is not listed in the domain's SPF record, but the domain asked receivers not to reject the message outright. It often goes to spam.

Last updated October 20, 2026 by the FindMyIPLocation team.