Email Header Analyzer

Email headers are metadata lines at the top of every email message that contain routing information, authentication details, and message metadata. Each header follows the format Header-Name: value. Headers are added by the original email client and by every mail server that processes the message along its delivery path. Key headers include From (sender), To (recipient), Subject, Date, Message-ID (unique identifier), Received (each server adds one), and authentication headers like SPF, DKIM, and DMARC results.

1. Parse and unfold: The raw header text is first unfolded by joining continuation lines (lines starting with whitespace) with their parent. Each header line is then split at the first colon to extract the header name and value.
2. Categorize and decode: Each header is categorized by type (identity, metadata, content, delivery, auth, or received). Identity and metadata headers with RFC 2047 encoded words (e.g., =?UTF-8?B?base64?=) are automatically decoded into readable text.
3. Trace the delivery path: Received headers are parsed in reverse order to create a chronological delivery timeline. Each hop is decomposed into its components: the sending server (from), receiving server (by), protocol (with), and timestamp.
4. Extract authentication results: The Authentication-Results header is parsed to extract SPF, DKIM, DMARC, and ARC results with their domains and pass/fail status. DKIM-Signature and Received-SPF headers are also examined for additional authentication data.

• SPF (Sender Policy Framework): Verifies the sending server IP is authorized by the domain owner. Published in DNS TXT records. Results: Pass (authorized), Fail (not authorized), Neutral (no policy), Softfail (temporary).
• DKIM (DomainKeys Identified Mail): Uses public-key cryptography to sign email headers and body. The signature is verified against a public key published in DNS. A Pass result ensures the email was not modified in transit.
• DMARC (Domain-based Message Authentication): Tells receiving servers what to do when SPF and/or DKIM fail. Policies: None (monitoring only), Quarantine (send to spam), Reject (block the email). DMARC helps prevent domain spoofing.
• ARC (Authenticated Received Chain): Preserves email authentication results across intermediate forwarding services (like mailing lists) that might break SPF or DKIM validation.

Your privacy is our priority. The Email Header Analyzer processes everything locally in your browser using pure JavaScript. Email headers you paste are never uploaded, stored, logged, or transmitted to any server. This means you can safely analyze sensitive email headers from personal or business correspondence, including authentication credentials and delivery path details, without any privacy concerns. The tool is completely free, with no signup, no API keys, and no usage limits - available whenever you need it for email forensics, delivery troubleshooting, or security analysis.