# Email Header Parser

URL: https://phishdestroy.io/developer-tools/email-header-parser
Category: Email
Where it runs: Runs locally (nothing you enter is uploaded)

Paste the raw headers of a suspicious message to see From, To, Date and Subject, every Received hop in order, and a table of all headers including Reply-To, Return-Path and Authentication-Results.

## Example input

Spoofed bank notice

```
Return-Path: <bounce@mailer.example.net>
Received: from mail.example.net (mail.example.net [203.0.113.25])
	by mx.example.com with ESMTPS id 4Xk2Lm; Mon, 19 Oct 2026 09:14:07 +0000
Received: from [198.51.100.10] (unknown [198.51.100.10])
	by mail.example.net with ESMTPSA id 77QaZ1; Mon, 19 Oct 2026 09:14:05 +0000
Authentication-Results: mx.example.com; spf=pass smtp.mailfrom=mailer.example.net; dkim=none; dmarc=fail (p=reject) header.from=example.org
From: "Example Bank Security" <security@example.org>
Reply-To: <help-desk@example.net>
To: <alice@example.com>
Subject: Action required: verify your account
Date: Mon, 19 Oct 2026 09:14:03 +0000
Message-ID: <20261019091403.1234@mail.example.net>
```

The top fields show the From display name and address, then two Received hops (Hop 1 is the server that received the message last). The table of all 10 headers shows a Reply-To on another domain and dmarc=fail, two signs of a spoofed sender.

## FAQ

### How do I read the Received hops?

Hop 1 is the topmost Received header, added by the last server that handled the message; the bottom hop is closest to the sender. Only hops added by your own mail provider can be trusted, because a sender can forge any Received lines below them.

### Does it check SPF, DKIM or DMARC?

No. It lists Authentication-Results, Received-SPF and DKIM-Signature as the receiving server wrote them, without verifying anything, decoding =?UTF-8?B?...?= subjects or reading the body, and it shortens long values (hops to 200 characters, table cells to 300). For a full .eml file, use EML Analyzer.

### Are the headers uploaded?

No. Parsing happens in your browser and nothing is sent anywhere. Headers can contain personal addresses and internal IPs, so remove those before you share them.

## Related tools

- [EML Analyzer](https://phishdestroy.io/developer-tools/eml-analyzer)
- [Email Authentication Checker](https://phishdestroy.io/developer-tools/email-auth-checker)
- [URL Defanger & IOC Extractor](https://phishdestroy.io/developer-tools/url-defanger)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [DNS over HTTPS Lookup](https://phishdestroy.io/developer-tools/dns-over-https-lookup)

All tools: https://phishdestroy.io/developer-tools