Evidence from a delivered message
Free email header analyzer.
Reveal the DKIM selector a message used, read the receiving system's SPF, DKIM and DMARC verdicts, and trace delivery hops. The pasted header never leaves this browser.
Local analysis complete
What this message header says.
Signature identity
DKIM selectors used
Receiver observations
Authentication results
Visible and transport identities
Sender identities
Different domains can be legitimate—for example, when a mailing platform sends on a business's behalf. Treat a mismatch as a prompt to inspect the receiver verdicts, not proof of fraud.
Oldest to newest
Delivery route
How to read it
Important findings
Boundaries matter
What this analysis can prove.
A header is evidence supplied by the message and the systems that handled it. It is useful, but context still matters.
Receiver verdicts carry more weight
Authentication-Results records what the receiving system observed. A DKIM-Signature only shows what the message claims it signed with.
Route times are estimates
They come from timestamps written by different mail servers. Clock differences and missing or altered fields can make a delay unavailable or misleading.
No score, no upload
The tool reports the evidence directly. It does not upload, save, rank or add the header to analytics.