Help / Email header analyzer
Email header analyzer
Reads an email’s raw headers and shows where it really came from: every server it passed through, whether SPF, DKIM and DMARC passed, and signs of spoofing or phishing.
How to use it
- Open the email and copy its full headers (the page lists where to find them in Gmail, Outlook, Apple Mail and Yahoo).
- Paste them into the box and press Analyze.
- Start with the verdict at the top, then read “What we noticed” for anything unusual.
- The route lists each server oldest first, with how long the message waited at each one.
Reading the results
- SPF
- Checks that the sending server is allowed to send for the envelope domain (Return-Path).
- DKIM
- A signature from the sending domain proving the message wasn’t changed in transit.
- DMARC
- Ties it together: passes only when SPF or DKIM passes for the same domain as the visible From address.
- Aligned
- The domain that passed SPF or DKIM matches the From address’s domain. That’s what makes the From address trustworthy.
- Received
- A line each server adds as it passes the message on. Read bottom to top; we show them oldest first.
- Reply-To
- Where your reply goes. When it differs from the sender, double-check before replying.
From the command line
curl "https://tools.nexayori.com/email-headers" curl "https://tools.nexayori.com/email-headers?format=json"
| (POST body) | The raw headers, as text or the form field “headers” (up to 64 KB) |
| format | text (default for curl), json, or html |
Questions
Is it safe to paste my headers?
They’re analyzed in memory and never stored or sent anywhere. Headers can contain your address and the sender’s, but not the message body.
It says “Can’t confirm”. Is it fake?
Not necessarily: many legitimate senders still don’t publish DMARC. It means the headers alone don’t prove who sent it, so be careful with links.
Why trust only the top Authentication-Results?
Your mail provider adds that one when it receives the message. Older ones further down could have been written by the sender.
Can I use it from a script?
Yes: curl --data-binary @headers.txt https://tools.nexayori.com/email-headers (add ?format=json for JSON).
Limitations
- Domain alignment uses a built-in list of country domain suffixes (like co.uk); unusual suffixes may be grouped too broadly.
- Results depend on what the receiving server recorded; some providers record less.