# Email Header Analyzer

Parse email headers locally to inspect hops, delays and reported authentication results. Optional IP lookups use our server.

Canonical: https://tamperbox.dev/email-header-analyzer

Reviewed: 2026-10-13

## Capabilities and processing

Paste raw message headers or drop an .eml file. Headers are parsed in your browser. Only when you choose Look up hop addresses are the public IP addresses, and nothing else, sent to our server for public DNS and network registry queries. Country is registry data, not physical location.

The route lists every Received hop, oldest first, with the delay at each server and TLS use. The authentication section reads the top Authentication-Results header and shows exact domain matches with From; relaxed alignment is not evaluated. Findings flag long delays, clock skew, unaligned results and a Reply-To on another domain.

## Example workflow

The sample is an order confirmation sent through a mail service. One server held it for 38 seconds; SPF passed for the service's domain, so DMARC relied on the aligned DKIM signature.

## Limits and interpretation

Received headers below your own servers can be forged by the sender; trust only the hops added by servers you control. Delays depend on each server's clock. The analyzer does not verify DKIM signatures; it reads the results the receiving server recorded. The application does not persist tool inputs or results.

## Related tools

[SPF Checker](https://tamperbox.dev/spf-checker), [DKIM Record Checker](https://tamperbox.dev/dkim-checker) and [DMARC Checker](https://tamperbox.dev/dmarc-checker) inspect the published records behind reported authentication results.

[All tools](https://tamperbox.dev/) · [Privacy](https://tamperbox.dev/privacy)

## References

[Authentication-Results: RFC 8601](https://www.rfc-editor.org/rfc/rfc8601) and [SMTP trace information: RFC 5321](https://www.rfc-editor.org/rfc/rfc5321).