Trace an email back through its hops

How to get the headers#

• Gmail: open the message, choose the three-dot menu, then Show original.
• Outlook (desktop): open the message, then File, Properties, and read Internet headers.
• Apple Mail: with the message selected, choose View, Message, All Headers, or Raw Source.

Paste the whole block of headers, not the message body. The tool needs the Received lines.

Reading the route#

Each mail server that handles a message adds a Received line at the top, so the chain reads from the bottom up: the bottom line is the first server, and the top is the last. The tool orders them for you and works out the delay at each hop from the timestamps. A long gap points to the server that held the message.

SPF, DKIM and DMARC#

SPF

Lists which servers may send mail for the domain in the message's envelope. It checks the path the message travelled.

DKIM

A cryptographic signature added by the sending domain. It checks that the signed parts were not altered on the way.

DMARC

A policy that ties the other two to the visible From address, and says what to do when they fail.

The results are written into the Authentication-Results header by the server that received the message, so the tool reports what that server concluded. "Pass" means the domain authorised the message. It does not mean the content is trustworthy: criminals send authenticated mail from domains they own. A failure is a reason for caution but not proof of forgery, because forwarding commonly breaks SPF.

Privacy#

Headers contain email addresses and server names. This tool works in your browser, and the headers are not sent to us. The addresses in the route can be looked up separately with an IP lookup if you want to know whose servers they are.