How to get the full email headers
- Gmail: open the message, click the three-dot menu → Show original, then Copy to clipboard.
- Outlook (web): open the message → three-dot menu → View → View message source.
- Outlook (desktop): open the message → File → Properties → copy the Internet headers box.
- Apple Mail: View → Message → All Headers, or Raw Source.
- Yahoo Mail: three-dot menu → View raw message.
What the analyzer shows
- Delivery path: every server that handled the message, in order, from the
Receivedheaders, with the delay at each hop. Long delays reveal queueing, greylisting or spam scanning. - Authentication results: the receiving server's verdicts for SPF, DKIM and DMARC.
- Spoofing signs: a Reply-To or Return-Path on a different domain from the From address, or authentication failures.
- Sending IPs: click any IP to geolocate it or check it against spam blacklists.
Reading Received headers
Each mail server adds a Received line at the top of the headers, so they read bottom-up: the lowest one is the first hop near the sender, the top one is your own provider's server. Only headers added by servers you trust (your provider's) are reliable; anything below can be forged by a spammer. That is why the authentication results added by your own provider matter most.
Frequently asked questions
Can I find the sender's real IP address?
Usually you find the IP of the sender's mail server, not their computer. Most webmail providers do not include the user's own IP.
DKIM passed but DMARC failed. Why?
DMARC requires the domain that passed SPF or DKIM to align with the From domain. A message signed by a third-party service with its own domain passes DKIM but fails DMARC alignment.
What does a large delay at one hop mean?
The message waited at that server: greylisting, rate limiting, a busy spam filter, or retries after a temporary failure.