Does It Upload The Email?

No. Parsing stays in the current browser tab. Headers may contain addresses, IPs and identifiers, so redact before sharing an exported report.

Why Can From And Return-Path Differ?

Legitimate senders often use bounce services or mailing platforms. A difference is a review cue, not automatic proof of fraud.

Does SPF Pass Mean A Message Is Safe?

No. SPF, DKIM and DMARC establish aspects of authorization and alignment; malicious or compromised authorized senders can still send harmful content.

Email Header Routing & Authentication Analyzer

Unfold raw email headers, map Received hops, summarize reported SPF/DKIM/DMARC, flag identity differences and export a private routing report.

Raw header

Local

Paste full message headers

From: "Billing Team" <billing@example.com>
Reply-To: support@example.net
Return-Path: <bounce@mail.example.com>
To: recipient@example.org
Subject: Invoice status
Date: Wed, 17 Sep 2026 09:04:00 -0700
Message-ID: <abc123@mail.example.com>
Authentication-Results: mx.example.org; spf=pass smtp.mailfrom=mail.example.com; dkim=pass header.d=example.com; dmarc=pass header.from=example.com
Received: from outbound.example.com (outbound.example.com [192.0.2.20]) by mx.example.org with ESMTPS; Wed, 17 Sep 2026 09:04:03 -0700
Received: from app.internal (app.internal [192.0.2.10]) by outbound.example.com with ESMTP; Wed, 17 Sep 2026 09:04:01 -0700

Headers can include addresses, IPs and message identifiers. Analysis stays in this tab; redact anything you do not need before sharing an export.

Authentication & routing

2 review notes

spfpass

dkimpass

dmarcpass

Routing hops2

From
"Billing Team" <billing@example.com>

Reply-To
support@example.net

Return-Path
<bounce@mail.example.com>

From and Reply-To use different domains; verify this is expected.

From and Return-Path use different domains. This can be legitimate, but deserves review.

Hop	From	By	Timestamp	Delay
1	app.internal (app.internal [192.0.2.10])	outbound.example.com	Wed, 17 Sep 2026 09:04:01 -0700	—
2	outbound.example.com (outbound.example.com [192.0.2.20])	mx.example.org	Wed, 17 Sep 2026 09:04:03 -0700	2s

Authentication-Results is reported by receiving systems; this page does not re-run DNS or cryptographically validate DKIM. A “pass” does not prove a message is trustworthy. Check links and requests independently.

Loading Tool…

What Is the Email Header Routing & Authentication Analyzer?

A local RFC-style header parser for routing and authentication triage. It unfolds continued fields, reverses Received entries into travel order, extracts server names and timestamps, estimates inter-hop delays, reads Authentication-Results and compares From, Reply-To and Return-Path domains.

How It Works

Paste headers copied from your mail client's Show original or message-source view, or open an EML/TXT file. Review the authentication cards, identity warnings and hop table, then export the parsed JSON if needed.

When to Use It

Investigate delivery paths, delays, spoofing indicators and mail authentication reports. A pass does not prove intent or safety, and copied Authentication-Results are not revalidated cryptographically by this tool.

Frequently Asked Questions

Does It Upload The Email?: No. Parsing stays in the current browser tab. Headers may contain addresses, IPs and identifiers, so redact before sharing an exported report.
Why Can From And Return-Path Differ?: Legitimate senders often use bounce services or mailing platforms. A difference is a review cue, not automatic proof of fraud.
Does SPF Pass Mean A Message Is Safe?: No. SPF, DKIM and DMARC establish aspects of authorization and alignment; malicious or compromised authorized senders can still send harmful content.

Found an issue? Send Feedback. See our data sources and update policy for tools that depend on changing information.