JPKCom DB

Mail Header Analyzer — Examples

Mail Header Analyzer walkthroughs: read the delivery route, check authentication, upload an .eml, interpret spam verdicts, and spot phishing signs.

Back to overview: Mail Header Analyzer · Open the live tool: www.jpkc.com/tools/mail-header/

This page shows the Mail Header Analyzer through concrete walkthroughs. How the individual functions work in detail is covered in the manual — here it's about typical real-world tasks.

Example 1: Play through the sample header

Goal: get to know the tool without having an email of your own handy.

  1. In the Parse tab, click Example. The text area fills with a realistic header and the analysis starts immediately.

Result: the tool jumps to the Overview and unlocks the four analysis tabs. The Findings card shows a green check mark: nothing stands out. In the Summary you see the decoded sender Jörg Müller <newsletter@example.com>, the sending server 198.51.100.42 with the badge Documentation (TEST-NET-2) (a reserved example address), green SPF/DKIM/DMARC pass badges "by mx.google.com", the SpamAssassin verdict ham, and four hops in 1m 54s. Key fields shows the subject as "Quartalsbericht Q1 – Grüße aus Köln" even though it's Base64-encoded in the message. From here you can click through Route, Security, and All Headers and see what a cleanly delivered message looks like — the ideal baseline for real cases.

Example 2: Analyze your own headers from Gmail

Goal: get to the bottom of a message you actually received.

  1. In Gmail, open the message → More (three-dot menu) → Show original.
  2. Copy the text and paste it into the Parse tab's text area. It doesn't matter whether you grab just the header block or the whole message — only the header section up to the first blank line is read.
  3. Click Analyze (or press Ctrl+Enter).

Result: the Overview shows findings, the summary, and the central fields. If you pasted the whole message, a purple note among the findings tells you the body was ignored. Using the copy icon next to a value, you can drop the Message-ID, say, straight onto the clipboard — handy when you need it for a support request or a log search. If a field occurs more than once, Key fields lists every occurrence, and the findings warn you if it's one of the fields that may appear only once.

Example 3: Read the delivery route and find a holdup

Goal: understand why a message arrived hours late.

  1. Paste the headers and click Analyze.
  2. Switch to the Route tab.

Result: the timeline starts with Written (the Date field) and runs from the green first hop to the blue last one. Between two hops sits the waiting time — in the sample header, for instance, "waited 1m 52s at mail-gw.example.com". A red gap (5 minutes and up) instantly reveals where it got stuck — often greylisting or a full queue. Below, the summary names the total transit time and the longest wait including the server. Watch the TLS marker per hop: an orange "no TLS recorded" flags a leg from a non-internal address for which no encryption was logged. If a Clock skew appears instead of a wait, the servers' clocks disagree — the real waiting time then can't be determined.

Example 4: Check SPF, DKIM, and DMARC

Goal: determine whether a message could authenticate itself.

  1. Paste the headers, Analyze, switch to the Security tab.

Result: every Authentication-Results field gets its own card. The one that counts carries the green badge "topmost — from your provider": a green pass for spf, dkim, and dmarc is the ideal case. A softfail or fail on SPF points to an unauthorized sending IP, a fail on DKIM to a broken signature (or a message altered in transit). The Details column shows which domain was checked (smtp.mailfrom=, header.from=, header.d=). Cards with the orange badge "added on the way — can be forged" are beside the point: a pass there proves nothing. The DKIM signatures table shows which domain signed and whether it matches the sender (Matches From). If the field is missing altogether, a notice says the receiving server recorded no checks — typical for internal or very old messages.

Example 5: Upload a .eml file

Goal: analyze a message stored as a file without copying headers out.

  1. In the Parse tab, click Upload and pick a .eml or .txt file (up to 25 MB) — or drag the file straight onto the text area.
  2. That's it.

Result: the tool reads the file locally, copies only the header section into the text area, and reports "Read the header section of …" — with "(body left out)" if it cut off a body. Then you land straight in the Overview. The file is not uploaded — everything happens in the browser. An Outlook .msg file is rejected, with a note on how to copy the headers in Outlook via File → Properties instead.

Example 6: Read the spam score

Goal: see whether a spam filter flagged the message.

  1. Paste the headers of a message that passed through a spam filter, Analyze, Security tab.

Result: the Spam filters card lists every detected value with filter, field, value, and verdict. For the sample header that's three SpamAssassin rows: Status No, score=-2.1 required=5.0 with the verdict ham, Tests with the rules that fired (BAYES_00, DKIM_SIGNED, …), and Score -2.1. So a negative score is a good sign; what matters is the distance to the required= threshold. With Rspamd, score and threshold share a row (e.g. -1.20 / 15.00); with Microsoft you get the SCL (5 and up spam), the filter verdict SFV, and the bulk mail value BCL (7 and up bulk). The verdicts also appear as badges in the Overview. If all spam headers are missing, it reads "No SpamAssassin, Rspamd or Microsoft spam fields found." — then the receiving server either checked nothing or didn't write the results into the headers.

Example 7: Search, copy, and save headers

Goal: find a specific header and pass the raw data on.

  1. After the analysis, switch to the All Headers tab.
  2. Type received, say, into the search field — the table narrows to matching rows.
  3. If needed, turn on Show raw values (encoded words not decoded) to see subjects and names in their original encoded form.
  4. Grab a single value via its copy icon, click Copy All for the complete header section, or use Download to save the file email-headers.txt.

Result: you have the headers at hand — for instance to pass them to a host or attach them to a ticket. Copy All and Download contain only the header section, even if you originally pasted the whole message.

Example 8: Check a suspicious message for phishing signs

Goal: find out whether a supposed bank email can be genuine. Say the header looks like this (addresses on example domains):

Received: from mail.bank-secure.example.net (mail.bank-secure.example.net [203.0.113.7])
        by mx.example.org with ESMTPS id 4Xyz12;
        Thu, 15 Oct 2026 09:12:40 +0200
Authentication-Results: mx.example.org;
       spf=pass smtp.mailfrom=bank-secure.example.net;
       dkim=pass header.d=bank-secure.example.net;
       dmarc=pass header.from=bank-secure.example.net
Authentication-Results: mx.example-bank.com; dkim=pass header.d=example-bank.com; dmarc=pass
DKIM-Signature: v=1; a=rsa-sha256; d=bank-secure.example.net; s=s1;
        h=from:to:subject:date; bh=abc=; b=def
From: "service@example-bank.com" <alert@bank-secure.example.net>
Reply-To: verify@payments.example
To: you@example.org
Subject: =?UTF-8?Q?Your_account_has_been_locked?=
Date: Thu, 15 Oct 2026 09:12:38 +0200
  1. Paste the header and click Analyze.
  2. Read the Findings card in the Overview, then open the Security tab.

Result: even though SPF, DKIM, and DMARC passed according to your provider, the tool reports three orange warnings: the display name contains service@example-bank.com, but the message comes from alert@bank-secure.example.net — a classic phishing trick. Reply-To points to an entirely different domain, so replies end up somewhere else. And there's no Message-ID. A purple note adds that there are two Authentication-Results fields and only the topmost comes from your provider. In the Security tab, the second field (mx.example-bank.com) carries the orange badge "added on the way — can be forged" — the sender wrote its pass for the real bank domain in there themselves. The bottom line: the authentication only proves that bank-secure.example.net sent the message, not that your bank is behind it.

Example 9: Remember headers and forget them again

Goal: compare several messages back and forth without pasting them in every time.

  1. In the Parse tab, turn on the Remember analysed headers in this browser switch.
  2. Analyze two or three messages one after the other.
  3. Switch between them via the Recent dropdown — entries carry the decoded subject, and a click loads and analyzes again.
  4. When you're done, click Forget or turn the switch off.

Result: as long as the switch is on, the tool keeps up to ten header sections in your browser's localStorage — never a body, never on a server. Forget or switching it off deletes them completely; the Recent dropdown then disappears too.

More on the individual functions is in the manual; strategic notes and pitfalls are in the tips & tricks. To dive straight in, open the tool.