Parse and analyze email headers to trace delivery path, check SPF/DKIM/DMARC, and detect spoofing indicators.
Paste a raw email header to turn its Received fields, sender identities, timestamps, and authentication records into a readable delivery and trust summary. The analyzer reconstructs the apparent relay path and highlights reported SPF, DKIM, and DMARC outcomes or suspicious inconsistencies. A common mistake is treating every header line as independently trustworthy. Messages can arrive with forged fields, and authentication results are meaningful only when they were added by a receiver you trust. Header contents are processed in the browser and are not uploaded.
The analyzer reads the Received fields that mail servers prepend as a message travels. Because each new entry is normally added above earlier entries, the raw header presents the newest hop first. The resulting view helps connect reported host names, IP addresses, protocol details, and timestamps while making gaps or abrupt changes easier to notice.
Authentication-Results and related fields are parsed to expose recorded SPF, DKIM, and DMARC outcomes. The analyzer also compares identities such as the visible From address, envelope sender, and DKIM signing domain where those values appear. It reports evidence contained in the header; a recorded result is not necessarily a fresh DNS lookup or an independent cryptographic verification.
No. It can organize routing claims and authentication evidence, but headers do not establish a person's identity. A trusted receiver's DKIM or DMARC result can support a conclusion about domain authorization and alignment. It does not prove which individual composed the message, and forwarded or modified mail can complicate otherwise legitimate results.
No. A DMARC pass indicates that the receiver reported acceptable domain alignment through SPF or DKIM. It does not inspect whether the message is truthful, harmless, or wanted. A malicious sender can authenticate a domain they control, and a compromised legitimate account can send authenticated phishing mail.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.