Email Header Analyzer

• What This Tool Does

Email Header Analyzer parses the raw headers of an email message to trace its delivery path, identify authentication results (SPF, DKIM, DMARC), measure delivery delays, and detect spam indicators.

• Why It Matters

• → Spam Detection: Identify forged or suspicious sender information
• → Deliverability: Diagnose why emails land in spam
• → Authentication: Verify SPF, DKIM, DMARC pass/fail results
• → Path Tracing: See exact route an email took from sender to recipient

• How to Read the Results

• ✓ Received headers: Read bottom-to-top (earliest server first)
• ✓ Authentication-Results: Shows SPF/DKIM/DMARC pass or fail status
• ✓ X-Spam headers: Mail server spam scoring (X-Spam-Score, X-Spam-Flag)
• ✓ Message-ID: Unique identifier for tracking a specific email

• Technical Background

Email headers are defined in RFC 5322 (Internet Message Format) and RFC 7001 (Authentication-Results header). Each mail server that handles an email prepends a "Received:" header containing: from (originating host), by (receiving host), via (protocol), with (transport security), id (message identifier), and timestamp. Reading Received headers from bottom to top reconstructs the complete delivery path from sender to recipient. The Authentication-Results header (prepended by the final receiving server) summarizes SPF, DKIM, and DMARC verification outcomes. "spf=pass" means the sending IP is authorized in the domain's SPF record. "dkim=pass" means the cryptographic signature verified correctly. "dmarc=pass" means the message is aligned with the domain's DMARC policy. DKIM-Signature headers contain the selector (s=), signing domain (d=), hashing algorithm (a=), and the base64-encoded signature (b=). Key headers for forensic analysis: Return-Path specifies the bounce address (envelope sender, which differs from From:). X-Originating-IP may reveal the actual client IP behind webmail portals. Reply-To sets a different address for replies, commonly manipulated in phishing. Date header timezone can hint at sender location. X-Mailer or User-Agent reveals the email client or sending platform. X-Spam-Score and X-Spam-Report headers (added by SpamAssassin and similar) explain why a message was flagged. Phishing and email fraud detection focuses on discrepancies: From: domain vs SPF/DKIM signing domain mismatch, Received chain showing unexpected geographic origins, authentication failures combined with domain lookalikes, and homograph attacks using Unicode characters in domain names. Analysts correlate Message-ID format, X-Mailer signatures, and IP geolocation to attribute emails to specific threat actors or sending infrastructure. In corporate security incident response, email header analysis is used to investigate phishing attacks, business email compromise (BEC), and account takeover attempts. Security teams extract indicators of compromise (IOCs) from headers: sending IP ranges, mail server fingerprints, unusual routing paths, and authentication failures. These IOCs are fed into SIEM systems and threat intelligence platforms. Automated email security gateways (SEGs) like Proofpoint, Mimecast, and Microsoft Defender for Office 365 use header analysis at scale to block threats before delivery. Manual header analysis remains an important skill for security analysts investigating emails that bypass automated filters.