What Email Header Analyzer helps you do

Paste raw email headers to inspect delivery hops, delays between Received lines, core routing fields, and coarse SPF, DKIM, and DMARC signals — entirely in your browser. Designed for triage, not forensic case management. It turns a wall of folded headers into a readable path so you can see where a message went and which authentication checks were recorded.

Header analysis runs locally in your browser. Haivix does not upload pasted headers to its servers, and the text is not stored after the page is closed.

How it works

Haivix unfolds folded header lines, parses key fields, reverses Received headers into hop order, estimates delays when Date headers parse cleanly, and scans Authentication-Results / Received-SPF text for spf=, dkim=, and dmarc= tokens. The parsing is pattern-based, so unusual formats can be reported as not found even when authentication happened elsewhere.

How to use Email Header Analyzer

Copy the full raw headers from your mail client (include Received, Authentication-Results, From, To, Subject, and Date).
Paste into the analyzer and review hop order, delays, and authentication summary.
Use the report as a starting point — confirm suspicious mail with your security team and original provider logs.
Re-check with headers from another recipient if you need to compare routing paths.

When to use it

Tracing why a message arrived late or took an unusual path
Checking whether SPF/DKIM/DMARC tags look pass/fail/not found in headers
Teaching or documenting header structure during support work
Comparing the route of a message that arrived with one that did not
Gathering evidence for a provider support ticket
Checking whether a forwarding step changed the envelope sender

When not to use it

Proving phishing attribution in legal or compliance investigations alone
Replacing full MIME parsing, attachment analysis, or sandbox detonation
Analyzing heavily redacted headers missing Received or auth fields
Making a safety decision from a single spf=pass token

Example

A delayed newsletter may show large gaps between consecutive Received timestamps; auth lines may read dkim=pass and spf=pass while dmarc=not found if DMARC was not present in the parsed headers. The gap points at the relay that queued the message, while the auth summary shows the message itself was authenticated at the edge.

What you can do with Email Header Analyzer

Unfold wrapped header lines into readable fields.
Show the Received chain in delivery order.
Estimate delays between hops when timestamps parse.
Extract From, To, Subject, Date, Return-Path and Message-ID.
Scan Authentication-Results and Received-SPF for spf, dkim and dmarc tokens.
Keep the entire analysis local to the browser.

Example: trace a delayed newsletter

Paste the full raw headers, including every Received line. Partial headers from a webmail preview often drop the earliest hops, which are the ones that explain the delay.

Read the hop list in delivery order and compare timestamps. A large gap points at the queue that held the message; a missing hop may mean the header was truncated.

Check the authentication summary, then confirm anything suspicious with the provider's own logs or your security team. The report is a starting point, not a verdict.

What to know before you start

Authentication parsing is regex-based on common header shapes — unusual formats may misreport.
Delay math depends on parseable Date/Received timestamps in the pasted text.
Headers alone cannot verify message body integrity or attachment safety.
A single passing authentication token does not establish that the content is trustworthy.
The analyzer does not resolve SPF records or fetch DKIM keys; it reads what the headers already recorded.

Common mistakes

Trusting display names in From: without checking Return-Path and auth results
Assuming spf=pass in one hop means the message is safe
Pasting headers that were truncated by a webmail UI
Reading Received lines top-down and reversing the actual path
Treating a missing dmarc token as a DMARC failure rather than an unparsed field
Ignoring clock skew between servers when comparing delays

Troubleshooting

If fields are missing, the paste may be truncated or the client may hide the full headers behind a menu. Copy the raw source rather than the rendered message.

If the hop order looks reversed, remember that the analyzer presents the chain in delivery order; the topmost Received line in the raw file is usually the last hop.

If a delay looks negative, the servers' clocks disagree. Treat the gap as approximate and use provider logs for exact timing.

If auth tokens show not found, the header may use a format the parser does not recognize. Search the pasted text for spf=, dkim= and dmarc= manually.

If the message came through a forwarder, the envelope sender may differ from the visible From. Check Return-Path and the forwarding hop before calling it spoofing.

Email Header Analyzer