MESSAGE DIAGNOSTICS / BROWSER TOOL
Email header analyzer
Read the authentication reports. Follow the delivery path.
ReplyLead's email header analyzer separates 3 common authentication methods - SPF, DKIM and DMARC - and reconstructs the Received chain from pasted headers. It displays reported results; it does not independently verify the message.
Updated 25 September 2026 - By Mark Glazer
Analyze a message header
Paste the original header block or start with the synthetic example. You do not need an account, an email address or access to a mailbox.
Maximum 256 KiB. The parser stops before the message body. No pasted text is included in tool analytics.
What the results tell you
| Output | What you can read | What it does not prove |
|---|---|---|
| Authentication reports | Method, reported result, reporting identifier and details, kept separately. | That the field is authentic or the reporting system is trusted. |
| Received hops | Reported routes and adjacent timestamp gaps, displayed oldest entry first. | The original sender's identity, exact physical route or reason for a delay. |
| DKIM signatures | The signing domain, selector and algorithm stated in each signature. | A valid cryptographic signature or DMARC alignment. |
| All fields | Unfolded values in their original header order. | A complete message, attachment analysis or malware verdict. |
A negative gap is shown as inconsistent timestamps. The tool does not silently turn it into zero. If an intermediate timestamp is missing, both adjacent gaps remain uncalculated: otherwise one displayed hop could accidentally absorb several servers' delays.
Find email headers in Gmail or Outlook
Gmail on a computer
Open the message, use the message's More menu and select Show original. Copy the original header text beginning with the first field. The Gmail header instructions explain where this view is located.
Outlook
In classic Outlook for Windows, open the message and select File, then Properties, then Internet headers. Other Outlook versions use different menus; follow Microsoft's version-specific header instructions. Copy the message details, not a screenshot.
Keep the first header field at the start of the input. A forwarded message pasted into an email body is not necessarily the original transport header. Use an example first if you are unsure which part to copy, and remove unrelated message content.
How this analyzer works
The parser unfolds continuation lines, retains repeated fields and stops at the first blank line. Authentication-Results, ARC-Authentication-Results and Received-SPF are displayed separately. Recognized method/result pairs are shown alongside their reported source; an absent method stays absent rather than becoming a failure.
The Received list is reversed for reading, from the bottom header entry toward the top. Each parseable timestamp is compared only with its adjacent predecessor. The timestamp must state a numeric timezone offset or UT, UTC, GMT or Z; missing or unsupported zones remain unparsed. DKIM metadata is read from signature tags. No DNS lookup, mailbox login or cryptographic verification runs as part of this analysis.
The downloadable JSON contains aggregate counts only: fields, hops, reported results, signatures, missing timestamps and negative gaps. It excludes raw headers, addresses, domains and host names. Clearing the input also clears the rendered results and disables the download.
Implementation behavior is described here so that you can decide whether this tool is suitable for your investigation. The synthetic example is a demonstration, not a customer email or an observed delivery benchmark.
Limits and the next useful check
This is a diagnostic reader, not a phishing verdict or a complete RFC validator. It does not establish DMARC alignment, identify the original sending IP or decide who filtered a message from a host-name substring. Signature presence is different from signature validity. Headers can be incomplete or forged.
Use the domain deliverability checker for published DNS records and the mail provider lookup for a domain's receiving MX environment. Read ReplyLead's email infrastructure research for measured DNS data with a stated sample and method. These answer different questions from a single message header.
ReplyLead operates cold email and LinkedIn outreach. For help with the wider outbound process, see how ReplyLead runs outbound or apply to work with ReplyLead. A passing authentication report alone is not an inbox-placement promise.
Email header analyzer questions
Does this tool verify SPF, DKIM or DMARC?
No. It displays results written into the pasted headers. It does not contact DNS, verify a DKIM signature or decide whether an Authentication-Results field belongs to a trusted receiver. A reported pass is not independent proof.
Why do two authentication reports disagree?
Different systems may record results at different points in delivery. A forwarded message can contain several reports, and header text can also be forged. This tool keeps each report and reporting identifier separate instead of choosing a single winner.
Why can SPF pass while DMARC fails?
A reported SPF pass alone does not establish a DMARC pass. DMARC also depends on alignment with the visible From domain and can use an aligned DKIM result. Use the receiving system's reported DMARC result and investigate its underlying identifiers.
Does a long hop delay prove greylisting?
No. The difference between two header timestamps does not identify its cause. Queueing, scanning, retransmission and inconsistent clocks are possible explanations. A missing timestamp prevents calculation for either adjacent gap.
Are pasted headers uploaded or stored?
The header parser runs in this browser tab and does not transmit or save pasted text. The page loads site assets and standard analytics. Tool events contain an action name, not header contents. Clear the input before leaving a shared computer.
Can I paste a whole email or an EML file?
Paste the text beginning with the first header field. The parser stops at the first blank line, before the message body. The limit is 256 KiB and 1,000 fields. File attachments, MIME body decoding and mailbox access are outside this tool's scope.
Sources and verification
Primary documentation checked 25 September 2026. These sources support the field definitions and mailbox instructions; they do not validate a pasted message or endorse this tool.
- Authentication-Results format and trust boundaries - checked 25 September 2026.
- Header folding and Received trace fields - checked 25 September 2026.
- DKIM signature domain and selector fields - checked 25 September 2026.
- Finding original headers in Gmail - checked 25 September 2026.
- Finding message headers in Outlook - checked 25 September 2026.