How to Read Email Headers for Delivery and Auth Clues
Paste raw email headers to trace delivery hops, delays, and SPF/DKIM/DMARC tokens locally—for triage, not forensic proof.
When mail is delayed, spoofed, or rejected, the useful evidence is often in the raw headers—not the visible body. Reading Received hops and authentication results is the first triage step before you open a full forensic case.
The Haivix Email Header Analyzer unfolds folded lines, summarizes From/To/Subject/Date/Message-ID/Return-Path, reverses Received hops into delivery order, estimates delays when timestamps parse, and pulls coarse SPF/DKIM/DMARC tokens from Authentication-Results and Received-SPF. Everything stays in the browser.
What you get from a good paste
Use the complete raw header block from your client or admin console—not a truncated webmail snippet. The report lists hop routes (from → by), delays between hops when dates parse, and auth tags when the regex finds mechanism=value pairs.
Copy the text report into a ticket. Pair DNS checks for SPF/DKIM domains with the DNS Lookup. Suspicious links in the body belong in the Campaign Link Checker, not this tool.
Honest limits
This is triage, not forensic proof, phishing attribution, MIME/body analysis, or a malware sandbox. Unusual Authentication-Results formats may show as “not found.” Delays need parseable Received dates. The tool does not verify body integrity or “prove safe.”
Checklist for a delivery incident
Open the Email Header Analyzer, paste headers, and copy the report. Haivix does not store the message.
- You pasted the full raw headers for the message.
- Hop order matches the path you expected.
- Large delays are noted with timestamps.
- SPF/DKIM/DMARC tokens were checked against DNS.
- You escalated to provider logs when headers were incomplete.