What Email Header Analyzer helps you do
Paste raw email headers to inspect delivery hops, delays between Received lines, core routing fields, and coarse SPF, DKIM, and DMARC signals — entirely in your browser. Designed for triage, not forensic case management.
Header analysis runs locally in your browser. Haivix does not upload pasted headers to its servers.
How it works
Haivix unfolds folded header lines, parses key fields, reverses Received headers into hop order, estimates delays when Date headers parse cleanly, and scans Authentication-Results / Received-SPF text for spf=, dkim=, and dmarc= tokens.
How to use Email Header Analyzer
- Copy the full raw headers from your mail client (include Received, Authentication-Results, From, To, Subject, and Date).
- Paste into the analyzer and review hop order, delays, and authentication summary.
- Use the report as a starting point — confirm suspicious mail with your security team and original provider logs.
When to use it
- Tracing why a message arrived late or took an unusual path
- Checking whether SPF/DKIM/DMARC tags look pass/fail/not found in headers
- Teaching or documenting header structure during support work
When not to use it
- Proving phishing attribution in legal or compliance investigations alone
- Replacing full MIME parsing, attachment analysis, or sandbox detonation
- Analyzing heavily redacted headers missing Received or auth fields
Example
A delayed newsletter may show large gaps between consecutive Received timestamps; auth lines may read dkim=pass and spf=pass while dmarc=not found if DMARC was not present in the parsed headers.
What to know before you start
- Authentication parsing is regex-based on common header shapes — unusual formats may misreport.
- Delay math depends on parseable Date/Received timestamps in the pasted text.
- Headers alone cannot verify message body integrity or attachment safety.
Common mistakes
- Trusting display names in From: without checking Return-Path and auth results
- Assuming spf=pass in one hop means the message is safe
- Pasting headers that were truncated by a webmail UI
Frequently Asked Questions
Paste the full raw headers from your mail client, including Received, Authentication-Results, From, To, Subject, and Date lines.
No. Parsing and analysis happen entirely in your browser.
Haivix scans common Authentication-Results and Received-SPF patterns. Unusual formats may show not found even when auth occurred elsewhere.
No. Header analysis helps triage delivery and auth signals; it does not replace security sandboxing or provider investigation.