- TraceFind
- Free tools
- Email header analyzer
Email header analyzer
Paste the raw headers of an email to see where it really came from: every server on the way, how long each step took, the sender’s IP address and whether SPF, DKIM and DMARC passed.
Runs in your browser. Nothing is uploaded.Paste the headers
Gmail: ⋮ → Show original. Outlook: File → Properties → Internet headers. Apple Mail: View → Message → All Headers.
How to read email headers
Every server that handles an email adds a Received line to the top of its headers. Read from the bottom up, they show the path from the sender’s computer to your inbox. The analyzer puts them in that order, works out the time between steps and picks out the first public IP address, which usually belongs to the sender’s mail server or, with some providers, to the sender’s own connection.
SPF, DKIM and DMARC
SPF checks that the sending server is allowed to send for the domain in the envelope sender. DKIM checks a cryptographic signature added by the sending domain. DMARC ties both to the domain you see in the From line. A message can pass SPF and DKIM for a lookalike domain and still be phishing, so the analyzer also compares the visible sender with the Return-Path, Reply-To, DKIM domain and Message-ID.
Signs of a spoofed email
- A sender name that contains a different email address than the real one
- Replies that go to another domain than the sender’s
- DMARC fail, or no DMARC policy on a domain that should have one
- Bulk-mail libraries such as PHPMailer on what looks like personal mail
Frequently asked questions
Are my headers sent anywhere?
No. The analysis runs in JavaScript on this page. The headers never leave your browser, and the page works offline once loaded.
Can the headers show the sender’s real location?
Sometimes. Webmail services usually hide the sender’s own IP and show only their servers. Mail sent from a desktop client or a small provider often includes the sender’s public IP, which points to an internet provider and a rough area, not an address.
Why does a delay show as negative?
Each server stamps the time with its own clock. A wrong clock, or a Received line that was added or edited later, makes a hop look like it happened before the previous one.
Where do I find the headers in Gmail?
Open the email, click the three dots next to Reply and choose Show original. Copy everything above the message text, or use Download original and open the .eml file here.
More free tools
Metadata viewer & remover
See the GPS location, device and author hidden in photos and documents, then strip it.
Open toolGoogle dork generator
Ready-made search operators for a name, email, username, phone number or domain.
Open toolHash & file intelligence toolkit
Hashes, real file type, entropy and embedded URLs, plus a hash identifier.
Open tool