// tool reference · Incident & Response
Email Header Analyzer Free
Parse email headers: hop path, SPF/DKIM/DMARC alignment, spoofing indicators.
What it does
Parses raw email headers into a readable hop path with authentication results — the deterministic companion to the AI phishing analyzer.
When to use it
- You want the mechanical facts about a message without an AI interpretation.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| headers | textarea | required | Raw headers (Show Original / View Source). |
What you get back
Hop path with timing, auth results, and alignment findings.
Worked example
Input
Received: from mail.evil.ru (mail.evil.ru [198.51.100.9]) by mx.example.com; Thu, 17 Jul 2026 09:14:02 +0900 From: billing@trusted-vendor.com Return-Path: bounce@evil.ru Authentication-Results: mx.example.com; spf=fail; dkim=none; dmarc=fail
Output (abridged)
VERDICT: SPOOFED -- authentication failed on every check
HOP PATH
1. mail.evil.ru (198.51.100.9) -> mx.example.com 09:14:02
A single hop from a host claiming to be a vendor.
AUTHENTICATION
SPF fail -- 198.51.100.9 is not authorised for evil.ru
DKIM none -- unsigned
DMARC fail -- alignment fails
ALIGNMENT
From: billing@trusted-vendor.com <- what the user sees
Return-Path: bounce@evil.ru <- where it came from
These do not match. The From header is free text; Return-Path is not.
Everything the user sees is attacker-controlled. The headers are not.
How it works
Deterministic parsing. Offline — no AI, no lookups.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
Headers can be forged, but Received chains are appended by each hop -- read them from the bottom up. It cannot verify a hop that lies about an upstream it invented.
Privacy
Nothing is stored.
Standards
SPFDKIMDMARCRFC 5322