Analyze raw RFC 822 email headers to verify sender authenticity, detect phishing or spoofing attempts, and map relay hops with transit latency measurements. 100% client-side parser.
Runs entirely in your browser
Every email carries a block of headers most people never see — a technical record of where the message came from and every server it passed through on the way to you. This analyzer parses raw RFC 822 headers so you can read that record: it checks the SPF, DKIM and DMARC authentication results that indicate whether the sender was who they claimed to be, and maps the chain of relay hops with the transit time between them.
That information is the most reliable way to judge whether a suspicious message is genuine or a phishing or spoofing attempt. A failed authentication result, or a “from” address that does not line up with the sending infrastructure, is a strong warning sign that the friendly display name is a disguise. Reading the hops can also help diagnose delivery delays by showing exactly where a message stalled.
The parser runs entirely in your browser, so the headers you paste — which can reveal internal hostnames and addresses — are not sent anywhere. To use it, open the original message’s full source or “show original” view in your mail client, copy the headers, and paste them in.
TechToolsHQ is an independent, reader-supported tech platform. If this free tool saved you time, solved a problem, or helped your workflow, consider supporting our work. Your support helps us keep our utilities 100% free, private, and ad-free for everyone.