ToolsEmail

Email header analyser

Paste an email's headers, or open a saved message, to see where it really came from, which servers it passed through, how long each took, and whether the sender's checks passed. Anything unusual is pointed out.

Read and explained in your browser: the message never leaves it

The message

Paste the message headers (or the whole message)

The top of the message down to the first blank line is all that's needed. You can paste a whole message, and only its headers are used.

Or choose a saved message (.eml), or drop one on this box

Nothing is uploaded. This page reads what you paste or choose inside your browser. The message isn't sent to abbott.cloud or anyone else, and it isn't kept.

How do I get a message's headers, or save it as a file?

Outlook (desktop): open the message in its own window, choose File > Properties, and copy the box called Internet headers. Outlook saves whole messages as .msg, which this page can't read, so copy the headers instead.
Outlook on the web: open the message, choose More actions (the three dots) > View > View message details, and copy what's shown.
Gmail: open the message, choose the three dots > Show original, then copy the text, or choose Download original to get an .eml file.
Apple Mail: choose View > Message > All Headers, or File > Save As to save an .eml file.
Thunderbird: choose File > Save As > File to save an .eml file, or View > Headers > All.

How this works

This page splits what you gave it into header lines (joining folded lines and decoding names such as =?UTF-8?B?…?=).
It reads each Received header (RFC 5321) to list the servers in order, the time each stamped, and the wait between them. Times are shown in UTC.
It reads Authentication-Results (RFC 8601), Received-SPF, DKIM-Signature and the ARC headers, and checks whether the domains line up with the From address as DMARC requires (RFC 7489).
It looks for signs of forgery: two From headers, a display name that is a different address, look-alike letters in a domain, replies sent elsewhere, missing headers, and times that don't add up. If the message went through Microsoft 365, its filtering fields are decoded too.

What's kept: nothing. The message is read here and never stored or sent.

Limitations:

Headers can be forged. The receiving side's headers are reliable; Received headers lower down were written by earlier servers and are only as honest as they were.
It reads the checks the receiving server recorded. It doesn't re-check a signature, which needs the original message body.
Outlook .msg files can't be read: copy the Internet headers instead.

Code: mailheaders.js (this page), mailui.js (the cards), mailparse.js (reading messages), mailanalyse.js (the analysis), msheaders.js (Microsoft 365 fields).