Email header analyzer, read in your browser.
Paste a message's headers to see who really sent it, whether it passed SPF, DKIM and DMARC, and where it was delayed.
Read in your browser. Nothing you paste is sent anywhere.
Gmail: Open the message, More (⋮) next to Reply, Show original.
Outlook (new, web): More actions, View, View message details.
Outlook (classic): Open the message, File, Properties, Internet headers.
Apple Mail: View, Message, All Headers.
Reading the route.
Every server that handles a message adds a Received: line on top, so the bottom one is the oldest and the top one is your own provider's. The analyzer turns them around into a route from the sender to you, with the time each hop took and whether it was encrypted. Only the lines your provider added can be fully trusted: a sender can write anything below them.
The verdict that counts.
Authentication-Results:holds the receiving server's SPF, DKIM and DMARC results. Read the top one; lower ones were added along the way or by the sender.ARC-Authentication-Results:keeps the results a forwarding server saw (a mailing list, a forwarding rule), so the final server can still trust a message that forwarding changed.- Alignment: DMARC passes when SPF or DKIM passes for a domain with the same organisational domain as the From address. A pass for an unrelated domain proves nothing about the sender you see.
Spam scores.
- SpamAssassin writes
X-Spam-Status:with a score, the score needed to call it spam, and the tests that fired. - Microsoft 365 writes
X-Forefront-Antispam-Report::SFVis the spam verdict,CATthe threat category,CIPthe connecting IP;X-Microsoft-Antispam:carriesBCL, the bulk complaint level. - Gmail shows no spam score in its headers.
Your privacy.
Headers hold names, addresses and IP addresses. This page reads them with code that runs in your browser and makes no network request with what you paste. The links in a result, such as an IP address to the IP lookup, send that one value only when you click them.
Questions people ask.
How do I find the full headers of an email?
In Gmail, open the message, choose More next to Reply, then Show original. In the new Outlook and Outlook on the web: More actions, View, View message details. In classic Outlook, open the message, then File, Properties. In Apple Mail: View, Message, All Headers.
What do spf=pass, dkim=pass and dmarc=pass mean?
SPF pass: the sending server is allowed to send for the envelope domain. DKIM pass: a domain's signature on the message checked out. DMARC pass: SPF or DKIM passed for a domain that matches the From address you see.
How can I tell if an email was spoofed?
Look at the top Authentication-Results header, written by your own mail provider. A DMARC fail for the From domain, a sender name that shows a different address, or replies going to an unrelated domain are the usual signs.
Is it safe to paste my email headers here?
Headers hold addresses and IP addresses, so it matters where they go. This analyzer runs in your browser and sends nothing you paste to Hivex or anyone else; nothing is stored.
Why was my email delayed?
The route shows when each server received the message. The hop with the long gap is where it waited, often in a queue or a retry after a temporary refusal. Times that go backwards only mean two servers' clocks disagree.
Hivex index
Short names, still free to register.
Starting something new? Hivex keeps a live index of short, brandable .si names nobody has claimed yet, each checked with the registry.
From code, or an AI assistant.
Hivex's free JSON API and MCP server check domains, DNS and registration records from your own code or from AI assistants that speak MCP. No key needed.
More Email tools
- Email deliverability checkerMX, SPF, DKIM, DMARC, MTA-STS, TLS reporting and BIMI in one report.
- SPF checkerEvery include followed, the 10-lookup limit counted, mistakes named.
- DKIM checkerFinds keys at common selectors and checks their type and size.
- DMARC checkerPolicy, alignment and report addresses, checked and explained.
- SPF generatorPick your mail services, get one record that stays under 10 lookups.
- DMARC generatorPolicy, reports and alignment, with a safe rollout path.
- MTA-STS checkerPolicy record, policy file, MX match and TLS reports.
- BIMI checkerRecord, DMARC, SVG logo and VMC or CMC, with a preview.
- Email blacklist checkerAn IP or a domain against live email blocklists.
- SMTP testGreeting, STARTTLS and sign-in methods on 587 and 465.
- Domain checkerIs a name free to register? Checked live on any extension.
Sources
- RFC 5322: Internet Message Format (header fields and folding)
- RFC 5321: SMTP, section 4.4: trace information (Received)
- RFC 8601: Message header field for indicating message authentication status
- RFC 8617: The Authenticated Received Chain (ARC) protocol
- RFC 7489: DMARC, section 3.1: identifier alignment
- Microsoft Learn: Anti-spam message headers in Microsoft 365
- Gmail Help: Trace an email with its full headers
- Apple Support: Show detailed headers in Mail on Mac
By Hivex. Updated 10 October 2026. Headers are read by this page, in your browser; nothing you paste is sent to Hivex or stored.