Free Email Header Analyzer & Relay Tracer
Paste raw email headers to trace originating sender IP addresses, audit SPF/DKIM/DMARC authentication results, and detect spoofing.
100% Free & PrivateInstant Live Results
How to Use Free Email Header Analyzer & Relay Tracer
Open your email client and copy the raw RFC 822 email headers ('Show original' in Gmail).
Paste the raw header text into the Email Header Analyzer text area.
Click 'RUN AUDIT' to execute instant relay hop parsing and authentication analysis.
Inspect the sender IP address, SPF/DKIM/DMARC pass/fail flags, and relay hop timeline.
Free Email Header Analyzer & Relay Tracer — Technical Verification Mechanics
Free Email Header Analyzer & Relay Tracer performs real-time queries against public DNS over HTTPS (DoH) endpoints, RDAP/WHOIS databases, SSL Certificate Transparency logs, and RFC protocol standards.
Zero-Retention Privacy Guarantee
Queries are executed statelessly directly in your browser or edge isolate. No scan queries, target URLs, or IP logs are saved to databases.
Real-Time RFC Compliance
Validates RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC), and TLS 1.3 standards to deliver accurate diagnostic feedback.
Free Email Header Analyzer & Relay Tracer — Frequently Asked Questions
How do I view raw headers in Outlook specifically?
Open the email, go to File > Properties, or use "View" > "View Source" depending on your Outlook version, then copy the full header text for analysis.
What does "Received-SPF: pass" vs "fail" mean in a header?
This line shows the actual SPF check result performed by the receiving mail server for that specific message — "pass" confirms the sender was authorized, "fail" is a spoofing red flag.
Can I find the sender's real IP address from an email header?
Often yes — headers include "Received" lines and sometimes "X-Originating-IP," which can reveal the originating mail server, though this can be obscured by relays or VPNs.
Is analyzing email headers useful for reporting phishing to IT or authorities?
Yes, raw headers provide the technical evidence (failed authentication, suspicious originating servers) that security teams and abuse reporting services need to investigate a phishing attempt.
Why do some legitimate emails show DKIM or SPF failures?
Forwarding through mailing lists, certain auto-forward rules, or misconfigured third-party senders can break alignment even for genuine emails — a header analyzer helps distinguish this from actual spoofing.
Do I need to worry about privacy when pasting email headers into an online analyzer?
Headers can contain IP addresses and routing info, so use a trusted analyzer and consider redacting personal content in the body/subject if privacy is a concern.
What is an email header analyzer used for?
It reads the raw technical header of an email — hidden metadata not shown in your inbox — to reveal the true sending server, delivery path, and authentication results.
How do I find the raw header of an email?
In Gmail, use "Show original"; in Outlook, use "View message details" or "Message options." Copy that raw text into an email header analyzer.
Can an email header analyzer tell me if an email was spoofed?
Yes — it shows whether SPF, DKIM, and DMARC passed or failed for that specific message, which is one of the clearest signs of spoofing when they fail.
Why does the "From" address look legitimate but the header shows a different server?
This is a classic spoofing tactic — the visible "From" name/address can be faked, but the header's "Received" chain reveals the actual originating mail server.
Do I need technical knowledge to read email headers?
Not with a header analyzer — it parses the raw text automatically and presents authentication results, sender IP, and routing in plain, readable terms.
What are email headers?
Email headers contain routing metadata added by mail servers as an email travels from sender to recipient. They include hop IP addresses, timestamps, authentication results (SPF, DKIM, DMARC), and client identifiers.
What does the Header Relay Inspector extract?
It parses every 'Received:' header line to trace the full relay hop chain from originating IP to recipient server, extracts Return-Path and From headers, checks Authentication-Results headers, and calculates hop delays.
Is my email header content saved anywhere?
No. Header analysis runs statelessly in your browser session or ephemeral Cloudflare Worker memory. We enforce zero-retention privacy and never log or store email headers.
What is hop latency / delay analysis?
Hop delay calculates the time elapsed between consecutive email servers in the relay chain. Unusually long delays (e.g. >30 seconds) can indicate greylisting, mail queue bottlenecks, or security inspection delays.
How do I view raw email headers on an iPhone or in Apple Mail?
Apple Mail's default app doesn't show raw headers easily; on Mac, use 'View' > 'Message' > 'All Headers,' or forward the email as an attachment to preserve headers for analysis elsewhere.
Can I analyze multiple email headers in bulk for an investigation?
Some advanced header analyzers support bulk upload, useful for security teams investigating a phishing campaign that hit multiple inboxes at once.
How is this different from MXToolbox's header analyzer?
Both parse raw headers and show authentication results; differences typically come down to how the routing path and pass/fail results are visualized and explained.
Can a header analyzer verify the actual DKIM cryptographic signature, not just whether it's present?
Yes, thorough analyzers actually validate the signature against the published public key, not merely check for the presence of a DKIM-Signature header.
What's the best way to preserve email headers when reporting phishing to IT or your provider?
Forward the suspicious email as an attachment (rather than a regular forward) so the original raw headers remain fully intact for the header analyzer and investigators to review.
Do email header analyzers work the same for headers from Outlook, Gmail, and Apple Mail?
Yes, headers follow the same universal internet email standard (RFC 5322) regardless of client, so a header analyzer processes them identically once you've copied the raw text.
What is an email header, in simple terms?
It's the hidden technical metadata attached to every email — showing the actual sending server, routing path, and authentication results — that isn't visible in your normal inbox view.
How do email header analyzers help investigate real estate wire fraud?
They reveal whether a suspicious 'updated wiring instructions' email actually passed authentication from the claimed sender's real servers, which is often the fastest way to confirm a spoofing attempt after the fact.
Are email header analyzers used in HR investigations?
Yes, HR and IT security teams use header analysis to verify the true origin of suspicious internal-looking emails, such as fake executive requests or impersonated colleague messages.
Can nonprofits use header analysis to investigate donor fraud attempts?
Yes, if a donor reports receiving a suspicious fundraising email, header analysis helps determine whether it genuinely originated from the nonprofit's systems or was spoofed.
Do law firms use header analyzers to respond to client-reported phishing attempts?
Yes, when clients report suspicious emails claiming to be from the firm, header analysis helps the firm's IT team quickly confirm whether it was a genuine spoofing incident.
Is understanding email headers useful for financial services fraud response teams?
Yes, fraud response teams routinely analyze headers from reported phishing attempts to trace origin, confirm authentication failures, and support both internal remediation and law enforcement reporting.
What is an email header analyzer and how to trace an email with headers?
An email header contains technical routing metadata showing every mail relay server the email traveled through, originating sender IP addresses, timestamps, and cryptographic authentication results (SPF, DKIM, DMARC). IncogSay's free email header analyzer parses raw RFC 822 headers to visually reconstruct the delivery path.
How to extract and view email headers in Gmail, Outlook, and Apple Mail?
In Gmail: Open the email, click the three vertical dots (More), and select 'Show original'. In Outlook (Web/Desktop): Open the email, click File > Properties, or select 'View message details'. In Apple Mail: Select View > Message > Raw Source. Copy the raw text and paste it into our tool.
How to check email source and trace sender IP from email headers?
Look for the bottom-most 'Received: from' header. This represents the original client or server that dispatched the email. Our tool automatically extracts the originating sender IP, geographical relay hops, and transmission delays.
How to read and translate email headers easily?
Raw email headers are verbose and difficult to read manually. IncogSay functions as a free email header translator — organizing complex headers into clean tables showing Sender, Recipient, Message-ID, SPF Pass/Fail, DKIM Signature, and Hop Delays.
Can email headers help detect phishing and fake sender display names?
Yes. Phishing emails frequently spoof the visible 'From:' name while the underlying 'Return-Path', 'Received' server IP, and 'Authentication-Results' header show a completely different, unauthorized sender domain.
Is IncogSay's email header analyzer tool free and private?
Yes. All header parsing runs statelessly in your browser session with 100% privacy and zero data persistence.