How do I view raw email headers?

In Gmail: open message, three-dot menu, Show original. In Outlook: File, Properties, Internet headers. Apple Mail: View, Message, Raw Source.

What are Authentication-Results headers?

MTAs add Authentication-Results documenting SPF, DKIM, and DMARC evaluation outcomes for each received hop.

What is the Received header?

Each mail server appends a Received header documenting when and from where it accepted the message, forming a reverse-chronological delivery trail.

Return-Path (envelope sender) specifies bounce delivery address and participates in SPF checks, which may differ from the visible From header.

Can attackers forge email headers?

Some headers like From are set by senders and easily forged. Authentication-Results added by receiving MTAs and DKIM signatures are tamper-evident.

What does dmarc=fail mean?

The message failed DMARC because neither SPF nor DKIM achieved alignment with the From header domain, a strong spoofing indicator.

Why do SPF and DKIM pass but DMARC fail?

Alignment failure: SPF passed for mail.example.com but From shows example.com without organizational domain match under strict alignment.

What is display name spoofing?

Attackers set friendly From names to impersonate executives while using unrelated email addresses hidden unless recipients inspect headers.

Authenticated Received Chain preserves authentication results across forwarding hops, adding ARC-Seal signatures verifiable by downstream MTAs.

How does the security score work?

The score weights authentication verdicts, From/Return-Path/Reply-To consistency, and known phishing heuristics into an aggregate risk rating.

Can I analyze headers from forwarded emails?

Yes, but original authentication may appear in ARC headers rather than top-level Authentication-Results. Include the full forwarded header block.

What is DKIM-Signature?

The signing MTA adds DKIM-Signature with selector, domain d=, and body hash b= that receivers verify against DNS public keys.

How do I trace the sender IP?

Find the bottom-most Received header (first hop) which typically shows the connecting IP address of the originating or relay MTA.

Are headers analyzed on ScanSuite servers?

No. Parsing runs entirely in your browser. Pasted headers are not uploaded to ScanSuite infrastructure.

What Reply-To mismatches indicate phishing?

When Reply-To points to a different domain than From, replies go to attackers while the message appears from a trusted sender.

How does this relate to the SPF DKIM checker?

The checker validates published DNS policies proactively; header analysis confirms whether a received message actually passed those checks.

What X-headers should I inspect?

X-Microsoft-Antispam, X-Google-DKIM-Signature, and X-Spam-Status provide vendor-specific spam scores and filter verdicts supplementing authentication results.

Is this email header analyzer free?

Yes. ScanSuite provides unlimited free client-side email header analysis without registration or daily limits.

Free Email Header Analyzer — Spam & Phishing

An email header analyzer parses raw RFC 5322 message headers, extracts Authentication-Results for SPF, DKIM, and DMARC verdicts, traces Received hop chains to identify sending infrastructure and delays, evaluates From/Reply-To/Return-Path consistency for spoofing indicators, and calculates an aggregate security score flagging likely spam, phishing, or legitimate delivery.

Paste the full raw email headers from your mail client into ScanSuite's email header analyzer and click analyze. The tool parses Authentication-Results, Received chains, Message-ID, From, Reply-To, and Return-Path fields, highlights SPF/DKIM/DMARC pass or fail status, maps routing hops, and assigns a security score with phishing and spam risk indicators.

Email headers contain the metadata trail that mail servers append as messages traverse the internet—from originating MTA IP addresses and authentication verdicts to forwarding hops, spam filter scores, and mailing list modifications. Security analysts, IT helpdesk staff, and vigilant users rely on header analysis to determine whether a message is genuine, spoofed, or part of a phishing campaign.

ScanSuite's free email header analyzer parses pasted raw headers entirely in your browser, extracting structured data from Authentication-Results, Received, DKIM-Signature, ARC-Seal, and X-* vendor headers. Results show whether SPF, DKIM, and DMARC passed or failed, whether the visible From address aligns with Return-Path and DKIM d= domains, and whether routing hops reveal suspicious geographic paths or known-abuse IP ranges.

ScanSuite's free email header analyzer parses raw message headers for SPF, DKIM, and DMARC authentication results, routing hop traces, and spoofing indicators. Paste headers from suspicious emails to receive instant security scores and phishing risk assessments entirely in your browser.

Frequently Asked Questions

How do I view raw email headers?: In Gmail: open message, three-dot menu, Show original. In Outlook: File, Properties, Internet headers. Apple Mail: View, Message, Raw Source.
What are Authentication-Results headers?: MTAs add Authentication-Results documenting SPF, DKIM, and DMARC evaluation outcomes for each received hop.
What is the Received header?: Each mail server appends a Received header documenting when and from where it accepted the message, forming a reverse-chronological delivery trail.
What is Return-Path?: Return-Path (envelope sender) specifies bounce delivery address and participates in SPF checks, which may differ from the visible From header.
Can attackers forge email headers?: Some headers like From are set by senders and easily forged. Authentication-Results added by receiving MTAs and DKIM signatures are tamper-evident.
What does dmarc=fail mean?: The message failed DMARC because neither SPF nor DKIM achieved alignment with the From header domain, a strong spoofing indicator.