What can I paste or open?

Use a raw header block or UTF-8 text file up to 1,000,000 bytes, with at most 10,000 fields and 50,000 physical header lines. The first empty line ends the headers. Any following message body is counted and excluded from the analysis and report. Your input stays in this tab and is not uploaded or saved automatically.

Why are Received fields shown in reverse order?

Mail systems usually prepend their Received field. Reversing the supplied field order exposes the earliest claimed hop first. The analyzer never sorts by dates because clocks can disagree and headers can be forged. The complete original Received value and source line remain available for each hop.

What does a negative hop delay mean?

It is the signed difference between two adjacent declared timestamps. For example, a 12:00:02 observation followed by 11:59:59 yields minus 3 seconds. The tool flags the negative difference without adjusting either clock. Missing or malformed dates make their adjacent comparisons unknown; the analyzer does not skip over them to invent a delay.

How are dates and display timezones interpreted?

Mail dates must include a timezone. Numeric offsets are supported, along with deterministic UTC and obsolete US mail-zone abbreviations. Invalid calendar dates, unsupported zones and leap seconds remain unknown with a diagnostic. Choose UTC, source or an IANA zone such as America/New_York for display. Changing display timezone does not change timestamps or signed delays.

Does this verify SPF or DKIM?

No. Authentication-Results and Received-SPF values are displayed as supplied declarations. DKIM-Signature tags are parsed as present data and explicitly remain unverified. The analyzer performs no DNS request, cryptographic signature check or sender authenticity assessment.

Are folded and repeated fields preserved?

Each continuation line is unfolded by removing its line boundary once while preserving its leading spaces or tabs. Repeated field names stay separate and retain their original order. You can inspect the original physical lines, malformed-line diagnostics and a complete selectable report. TXT and clipboard reports include all fields and hops, regardless of the current table page.

Email Header Analyzer

Paste raw mail headers or choose a local UTF-8 file to inspect its Received route, adjacent clock differences and authentication declarations. The analyzer retains repeated fields, unfolds continuations once and explains malformed lines or unknown dates. Copy or download a complete report with every parsed field and diagnostic.

Trace the declared route.Local parsing · no upload

Raw message headers

Header blockUp to 1,000,000 UTF-8 bytes. Repeated fields and folded lines are retained. The first empty line ends the header block.Or choose a local UTF-8 fileDisplay timezoneUTC, source, or an IANA zone such as America/New_York. Display changes never alter observed instants or delays.

The synthetic example demonstrates a +2 second hop followed by a −3 second clock difference. Raw headers stay in this tab and are never saved automatically.

Received route and timing

Follow the header trailAnalyze your header block to inspect observed hops, signed delays and original declarations.

Synthetic example preview. Paste your headers or choose a local file, then analyze.

Fields: Not parsed

Received hops: Not parsed

Negative delays: Not parsed

Unknown dates: Not parsed

Read the observations

Folded SubjectOne logical field
Subject: first followed by a tab-indented second line becomes one unfolded value; the tab remains.
Negative delayClock evidence
12:00:02 followed by 11:59:59 is −3 seconds. The sign remains visible and the hops keep reversed header order.
Unknown dateNo inferred instant
An unsupported timezone, invalid calendar date or missing separator leaves the date and dependent delays unknown.

Accuracy. Headers can be forged; results are declarations, not sender authenticity, inbox placement or security certification.

Common questions

What can I paste or open?: Use a raw header block or UTF-8 text file up to 1,000,000 bytes, with at most 10,000 fields and 50,000 physical header lines. The first empty line ends the headers. Any following message body is counted and excluded from the analysis and report. Your input stays in this tab and is not uploaded or saved automatically.
Why are Received fields shown in reverse order?: Mail systems usually prepend their Received field. Reversing the supplied field order exposes the earliest claimed hop first. The analyzer never sorts by dates because clocks can disagree and headers can be forged. The complete original Received value and source line remain available for each hop.
What does a negative hop delay mean?: It is the signed difference between two adjacent declared timestamps. For example, a 12:00:02 observation followed by 11:59:59 yields minus 3 seconds. The tool flags the negative difference without adjusting either clock. Missing or malformed dates make their adjacent comparisons unknown; the analyzer does not skip over them to invent a delay.
How are dates and display timezones interpreted?: Mail dates must include a timezone. Numeric offsets are supported, along with deterministic UTC and obsolete US mail-zone abbreviations. Invalid calendar dates, unsupported zones and leap seconds remain unknown with a diagnostic. Choose UTC, source or an IANA zone such as America/New_York for display. Changing display timezone does not change timestamps or signed delays.
Does this verify SPF or DKIM?: No. Authentication-Results and Received-SPF values are displayed as supplied declarations. DKIM-Signature tags are parsed as present data and explicitly remain unverified. The analyzer performs no DNS request, cryptographic signature check or sender authenticity assessment.
Are folded and repeated fields preserved?: Each continuation line is unfolded by removing its line boundary once while preserving its leading spaces or tabs. Repeated field names stay separate and retain their original order. You can inspect the original physical lines, malformed-line diagnostics and a complete selectable report. TXT and clipboard reports include all fields and hops, regardless of the current table page.

Headers can be forged; results are declarations, not sender authenticity, inbox placement or security certification.