Can an email header be faked?

Partly. A sender can write any From address and add fake lines at the bottom of the headers. They can't fake the lines your own provider adds at the top, including the SPF, DKIM and DMARC results.

Can I find the sender's IP address?

Often, yes: it's in the first Received line added by your provider. But big providers like Gmail and Outlook.com hide the sender's home IP address, so you usually only see their server.

Is it safe to paste headers here?

Yes. The analyzer runs entirely in your browser and nothing is sent anywhere. Headers can contain your email address, so don't paste them into tools you don't trust.

Email header analyzer

Every email carries hidden headers that record where it came from and whether it passed security checks. Paste them here to read them in plain English.

How to copy the full headers

Gmail (computer): open the email, click the three dots next to Reply, choose Show original, then Copy to clipboard.
Outlook on the web and new Outlook: open the email, click the three dots, choose View, then View message details, and copy everything.
Classic Outlook for Windows: open the email in its own window, choose File, then Properties, and copy the Internet headers box.
Apple Mail: open the email, choose View, then Message, then All Headers (or Raw Source).
Yahoo Mail: open the email, click the three dots, choose View raw message.

What the analyzer shows

Part	What it tells you
From, Reply-To, Return-Path	Who the email says it is from, where replies go, and where bounces go. When these point to unrelated domains, look closer.
SPF, DKIM, DMARC	Whether the email passed the sender domain's security checks, as recorded by your provider
Route	Each server the email passed through, in order, with the delay at each step
Warning signs	Failed DMARC, replies redirected to another domain, and a display name that shows a different address

Which headers can you trust?

Headers are added from the bottom up as an email travels. The ones near the top were added by your own provider and can be trusted. Anything lower down, and the From line itself, can be written by whoever sent the message. That is why the SPF, DKIM and DMARC results added by your provider matter more than what the email claims about itself.

What the email header analyzer does

Paste the hidden headers from any email and this tool turns them into a plain-English report: who sent it, where replies go, whether it passed SPF, DKIM and DMARC, and the route it took to reach you. It helps you decide whether a suspicious email is real, and helps senders see why their mail is being delayed or flagged.

Benefits

A quick overall verdictThe report opens with a summary such as Nothing unusual found, Some things to check, or Warning signs found, plus how many header lines and hops were read.
Key details pulled outFrom, Reply-To, Return-Path, To, Subject, Date and Message-ID are shown together in one small table, so you do not have to hunt through the raw text.
Security checks at a glanceSPF, DKIM and DMARC results are shown as pass, fail or not found, along with the domain that signed the message with DKIM.
Spoofing warning signsThe tool flags failed DMARC, replies that go to a different domain, and a display name that shows a different email address than the real sender.
The full delivery routeEvery server the message passed through is listed in order, with the time at each step, the delay between steps and the total travel time.
Spots slow deliveriesAny hop that took more than five minutes is called out, which helps explain why an email arrived late.
Spam filter scoresWhen present, the spam status line and Microsoft's spam score (SCL) are shown in the authentication section.
Paste the whole message if easierYou can paste the full message source. Only the header section at the top is read.

Who it is for

Anyone who got an email that looks like it came from their bank, a supplier or their boss and wants to check before clicking or replying.
A small-business owner whose customers say their emails land in spam and who wants to see the SPF, DKIM and DMARC results.
An office manager or IT helper looking into why an email took hours to arrive.
A bookkeeper checking whether an invoice email with new payment details really came from the vendor.
A marketer confirming that their email service is signing campaigns correctly.

How to use it

Open the email in Gmail, Outlook, Apple Mail or Yahoo and copy the full headers or original message.
Paste them into the box.
Press Analyze headers.
Read the summary and warning cards first, then check the route table for delays.

Your privacy

The headers are read and analyzed entirely in your browser. Nothing you paste is sent to ListaFix or any other server.

Questions people ask

Can an email header be faked?: Partly. A sender can write any From address and add fake lines at the bottom of the headers. They can't fake the lines your own provider adds at the top, including the SPF, DKIM and DMARC results.
Can I find the sender's IP address?: Often, yes: it's in the first Received line added by your provider. But big providers like Gmail and Outlook.com hide the sender's home IP address, so you usually only see their server.
Is it safe to paste headers here?: Yes. The analyzer runs entirely in your browser and nothing is sent anywhere. Headers can contain your email address, so don't paste them into tools you don't trust.