Header forensics · runs in your browser
Paste raw headers or drop an .eml file to trace every hop, measure delivery delays, find the origin IP and check SPF, DKIM and DMARC, with every result explained in plain English.
Gmail: ⋮ menu → Show original. Outlook: File → Properties → Internet headers. Apple Mail: View → Message → All Headers. Thunderbird: View → Message Source. From an .eml file only the header part is read.
DNS checks query Cloudflare’s public resolver from your browser.
Two free services that fit an email-debugging workflow.
cleantempmail.com
A free temporary inbox for deliverability checks. Open an address instantly, with no sign-up, send a message from your domain to it, then paste its headers into the analyzer above.
webtracecheck.com
When a header analysis points at a suspicious sender, look further without risking your own machine.
No. The analyzer is JavaScript running in your browser and sends nothing you paste or open anywhere. When you open an .eml file, only the header section at the start of the file is read, and the file never leaves your device.
In Gmail open the message, use the three-dot menu and choose Show original. In Outlook for desktop open the message and choose File, Properties, then copy the Internet headers box. In Apple Mail choose View, Message, All Headers. In Thunderbird choose View, Message Source. Copy everything above the message text, or save the message as an .eml file and open it here.
Every server adds its Received header at the top, so the newest hop comes first in the raw text. The analyzer reverses them to show the path from the sender to you, and computes the delay between consecutive timestamps.
Each timestamp comes from that server’s own clock. If one clock is a few seconds or minutes off, a hop can appear to happen before the previous one. It makes the delays around that hop unreliable, but it rarely says anything about the message itself.
The analyzer marks the first hop whose connecting IP is outside private and reserved ranges as the origin. For mail sent through a provider such as Gmail or Microsoft 365 this is usually the provider’s outgoing server, not the sender’s own computer.
Yes. Everything below the first Received header written by your own mail provider can be invented by the sender. Trust the Authentication-Results header that your provider added near the top, and treat lower ones as claims.