Email Header Parser
Free online email header parser. Verify SPF, DKIM, and DMARC results and spot spoofing - all client-side.
Loading tool...
What is Email Header Parser?
An email header parser breaks down the raw RFC 5322 metadata that travels with every message: routing fields like Received and Delivered-To, authentication results such as SPF, DKIM, and DMARC verdicts, and transport details like Message-ID, X-Mailer, and timestamps. It unfolds folded header lines, decodes RFC 2047 MIME encoded-words so internationalized subjects become readable, and orders the Received hops into a delivery timeline you can audit.
Key Benefits
- Reveal spoofing by exposing mismatches between From, Return-Path, and Reply-To domains
- Pinpoint delivery delays with per-hop Received timestamps across the relay chain
- Verify SPF, DKIM, and DMARC outcomes directly from the Authentication-Results header
- Decode base64 and quoted-printable encoded subjects into human-readable text instantly
- Keep sensitive headers private with fully client-side parsing - no uploads required
Common Use Cases
- •Investigating suspected phishing or spoofed business email compromise messages
- •Troubleshooting slow or bounced deliveries with mail administrators
- •Auditing DMARC, DKIM, and SPF deployment for your own domain
- •Learning how SMTP routing works from real message traces
How to Analyze Email Headers
- Get the original message source: In Gmail open the message, choose Show original; in Outlook use View message source. Copy everything above the message body.
- Paste into the parser: Paste the raw headers into the input box. Fields parse instantly as you type, including folded continuation lines.
- Read the decoded fields: Review From, Return-Path, Reply-To, and Authentication-Results to verify SPF, DKIM, and DMARC outcomes and spot domain mismatches.
- Follow the Received chain: Trace hops from most recent back to the origin server using timestamps to locate delays or unexpected relay hosts.
Key Features
- Full RFC 5322 field parsing with automatic unfolding of folded multi-line header values
- RFC 2047 encoded-word decoding for both B (base64) and Q encodings
- Received hop chain reconstruction showing every server a message traversed
- Instant decoding of internationalized subjects like =?UTF-8?B?...?= into readable text
- One-click copy of all decoded fields as clean name: value text
- 100% client-side processing - headers never leave your browser
Frequently Asked Questions
Is it safe to paste my email headers here?
Yes. Parsing runs entirely in your browser with JavaScript - nothing is uploaded to any server. Still, avoid pasting the message body since it may contain sensitive content.
What does =?UTF-8?B?...?= in the Subject mean?
That is an RFC 2047 MIME encoded-word used to carry non-ASCII text in headers. This tool automatically decodes both B (base64) and Q encodings so you can read the original subject.
How do I read the Received headers?
Each Received header records one server-to-server handoff. The topmost hop is the most recent server that received the message; reading downward walks the path back toward the original sending server.
Can this tool tell me if an email is phishing?
It gives you strong signals: mismatched Return-Path, Reply-To, and From domains, failed SPF/DKIM/DMARC results in Authentication-Results, and suspicious relays in the Received chain. Use these together to judge legitimacy.