# Email Header Analyzer Source: https://wraps.dev/tools/email-header-analyzer ![Wraps Logo](https://wraps.dev/wraps-light-logo.png)![Wraps Logo](https://wraps.dev/wraps-dark-logo.png) ](https://wraps.dev/) [](https://github.com/wraps-team/wraps)[Log in](https://app.wraps.dev/auth?mode=signin)[Sign up](https://app.wraps.dev/auth?mode=signup) Toggle menu wraps ยท free tool Paste raw headers and read the hop chain, the SPF, DKIM and DMARC results, and whether Return-Path lines up with From. Your headers never leave the browser. Paste the raw headers Raw message headers Parsed in your browser. Nothing is uploaded, stored, or put in the URL. Clear ## What gets parsed Paste the full header block of a message and the tool unfolds continuation lines, as RFC 5322 section 2.2.3 describes, then pulls out the parts you usually go looking for. The Received headers become a hop list, shown oldest first, with the time between each hop. The Authentication-Results header is split into SPF, DKIM and DMARC results, each with the domain it was evaluated against. From, Return-Path, Subject, Date and Message-ID are listed next to them. Raw headers put the newest Received line at the top, because each server prepends its own. Read bottom to top to follow the message. The tool reverses the list so hop 1 is where the message first entered the chain. ## Your headers stay in the page Headers carry recipient addresses, internal hostnames and IP addresses. This page parses them with plain string handling in your browser. It makes no network request with them, does not write them to local storage, and does not put them in the URL, so they do not end up in analytics or browser history. ## Reading Received delays The delay column is the difference between two timestamps written by two different servers. If their clocks disagree you will see a negative or oddly large number. A jump of several minutes between hops usually means a queue or a greylisting retry. A jump of hours often points at a receiving server that deferred the message. When a timestamp does not parse, the tool skips that delay instead of guessing. Received headers are also easy to forge below the first trusted hop. Treat the hops added by your own provider as reliable, and anything earlier as a claim. ## Authentication-Results and alignment The receiving server writes Authentication-Results after it checks the message. A pass on SPF means the sending IP is allowed for the domain in smtp.mailfrom. A pass on DKIM means a signature verified for the domain in header.d. DMARC then asks a further question: does either passing domain match the domain in the visible From header? That is why the tool compares Return-Path with From. Mail sent through an ESP often carries the ESP's bounce domain in Return-Path, so SPF passes for the ESP and DMARC still fails for you. The comparison here uses a simple rule, the last two labels of each domain. It is a heuristic and it is wrong for suffixes like co.uk, since we do not ship the public suffix list. The receiver's own dmarc= line is the verdict that counts. Amazon SES sends from an amazonses.com bounce domain unless you set a custom MAIL FROM domain. Easy DKIM on your own domain is what gives you a DKIM-aligned pass either way. ## Platform hints A few headers name the system that sent a message: X-SES-Outgoing and Feedback-ID with amazonses for Amazon SES, X-Mailgun headers for Mailgun, X-SG-EID or X-SG-ID for SendGrid, X-PM-Message-Id for Postmark, and X-Google headers for Google. The tool only lists a platform when one of those headers is actually there. A missing hint tells you nothing, because senders can strip these headers. ## Questions ### How do I get the raw headers? In Gmail, open the message, use the three dot menu and choose Show original. In Outlook on the web, open the message and choose View message source or details. In Apple Mail, use View, Message, All Headers. Copy the block at the top, up to the first blank line. ### Is it safe to paste real headers here? The parsing runs in your browser and nothing is sent, stored, or added to the URL. Still, redact anything you would not share in a screenshot if you plan to post the results elsewhere. ### Why does DMARC fail when SPF and DKIM both pass? DMARC needs the passing domain to align with the From header domain. If SPF passes for a bounce domain that differs from From, and DKIM is signed with the sender's own domain, both pass and DMARC still fails. ### Why are some Received delays negative? Each hop's timestamp comes from a different server's clock. When two clocks disagree the difference can come out negative. It is usually clock skew, not a fault. ## Keep going To see how a domain is set up rather than one message, use the [full deliverability checker](https://wraps.dev/tools) or the [DMARC record checker](https://wraps.dev/tools/dmarc-checker). For the alignment concept, read [DMARC alignment](https://wraps.dev/glossary/dmarc-alignment).