Trace Email Headers

About Trace Email Headers

Every email carries hidden technical headers alongside the visible subject and body — sender and recipient addresses, a unique message ID, and critically, a "Received" line added by every mail server the message passed through on its way to your inbox. These headers are normally hidden by your email client, but viewing them (via "Show Original" in Gmail or "View Source" in Outlook) reveals the full delivery path and can help spot spoofed or suspicious emails.

This tool parses raw email headers pasted directly from your email client and extracts the key fields (From, To, Subject, Date, Return-Path, Message-ID) into a readable summary, then walks through every "Received" line to reconstruct the delivery path — which server the message came from, which server received it, and when — in order from most recent to oldest.

A mismatch between the visible "From" address and the actual sending server in the earliest "Received" line is one of the classic signs of a spoofed phishing email, since legitimate senders' infrastructure is generally consistent with their claimed domain. This tool surfaces that delivery path clearly, but interpreting whether a specific hop looks suspicious still requires some judgment about what's normal for the sender in question.

How it works

1. Get the raw headers. In Gmail, use "Show Original"; in Outlook, use "View Source" or the message properties.
2. Paste the headers. Paste the full raw header block into the text box.
3. Review the summary and delivery path. See key fields and the full server-to-server hop sequence.