Email Header Analyzer & Hop Tracer
Analyze raw RFC 5322 email headers to trace SMTP relay hop sequences, calculate transit delays between mail transfer agents (MTAs), inspect Authentication-Results (SPF, DKIM, DMARC), and detect spoofing attempts.
Email Header Input
Paste the raw headers of an email to trace its routing path and audit SPF/DKIM/DMARC flags.
Understanding RFC 5322 Email Headers & Relay Hops
Every Internet email message contains structured metadata headers defined by RFC 5322 (which updated RFC 2822 and RFC 822). Each Mail Transfer Agent (MTA) that processes or forwards the message prepends a new Received: header at the top of the header block.
How to Read SMTP Relay Hops
Because each relay prepends its header to the top, email headers must be read from bottom to top to follow the chronological path from original sender to final destination inbox:
- Origin (Bottom-most Received Header): Shows the originating client IP address, mail client, or webmail server that accepted the initial message submission.
- Intermediate Hops: Show intermediate SMTP relays, spam filtering proxies, and MX gateways that handled the message.
- Final Delivery (Top-most Received Header): Shows the destination mail server that delivered the message to the recipient's mailbox.
Key Headers to Inspect During Troubleshooting
Authentication-Results: Contains evaluation status for SPF, DKIM signatures, and DMARC alignment performed by the receiving server.Return-Path: Specifies the envelope sender address used for bounce notifications (which must align with SPF checks).Message-ID: Unique string identifier generated by the originating mail system.X-Spam-Status/X-Spam-Score: Spam filter score appended by anti-spam engines (such as SpamAssassin or Exchange Online Protection).