Email Header Parser
Understand Any Email's Journey

The sender's display name and email address. Note: the display name is free-text and can be anything. Always verify the actual email address after the @ symbol matches the claimed organization.

The primary recipient(s) of the email. If the To address is not yours but you still received the email, you were likely blind-carbon-copied (BCC) — a pattern common in mass phishing campaigns.

The timestamp when the email was sent, as claimed by the sender's mail server. Can be forged — cross-reference with the Received headers for the actual delivery time.

The email subject line. Subject lines are unverified metadata — any content can be placed here.

A globally unique identifier for this email, generated by the sending mail server. Used to reference emails in threading and for delivery tracking. Legitimate Message-IDs include the sending domain after the @ symbol. A mismatch between the Message-ID domain and the From domain can indicate spoofing.

The address that replies will be sent to. When Reply-To differs from the From address — especially pointing to a different domain — this is a classic phishing signal. Legitimate transactional emails rarely set a Reply-To different from the sender.

A series of Received headers, one added by each mail server that handled the email. Read from the bottom up to trace the email's origin. The bottom-most Received header shows where the email originated. Unexpected intermediate servers or servers not associated with the claimed sender's domain indicate relaying or spoofing.

SPF result indicating whether the sending server is authorized by the claimed domain's DNS records. "spf=pass" means the server is authorized. "spf=fail" or "spf=softfail" means the server is not on the domain's authorized list — a significant red flag for spoofing.

DKIM result indicating whether the email's cryptographic signature is valid. "dkim=pass" means the email was signed by the claimed domain and has not been tampered with since. "dkim=fail" means the signature is invalid or missing — the email may have been modified in transit or forged.

DMARC result combining SPF and DKIM checks. "dmarc=pass" means the email aligns with the domain's published policy. "dmarc=fail" means both SPF and DKIM alignment failed — this is the clearest authentication indicator that the email is not from who it claims. Legitimate banks and financial institutions almost always publish strict DMARC policies.