What is an email header analysis tool? How to investigate the source and delivery route of suspicious emails

§1. I sympathize with this concern: Is the email I received really real? Or is it spoofing?

"I received an important email from a business partner, but the sender address seems a little different than usual..."

"The notification email from the system arrived hours late, but I would like to find out which server caused the delay..."

“I want to identify the real source (IP address) of suspicious spam emails and understand their origin so that I can take appropriate measures.”

Have you ever felt doubts or concerns about business or daily email exchanges? The modern digital landscape is fraught with sophisticated phishing attempts and business email compromise (BEC) attacks that prey on exactly these kinds of uncertainties.

The "From" displayed on the email software screen can actually be easily spoofed. Attackers can forge the visible sender information with minimal effort, making it extremely difficult to accurately determine whether an email is genuine or spoofed'' by a malicious third party just by looking at the standard sender information provided in your typical email client interface.

To find clues for further investigation about the routing path of the email, you can analyze the email header (EML/Raw source) to understand its routing and authentication status for limited diagnostic purposes. Keep in mind from the start that the header alone does not definitively prove the true identity of the sender. The header serves as a technical log of the email's journey and the security checks it underwent before reaching your inbox. Let's delve into what this means and how you can leverage these insights effectively.

§2. Explanation of the cause: Important information that can be read from email headers and the analysis mechanism

An email header is a vast collection of metadata and routing information that is appended to the email message before the actual body content. It acts much like a collection of postmarks and relay station stamps affixed to physical mail items, and contains very important technical information such as the following.

① Received header (delivery route and delay history)

The history of mail servers that an email passes through from the sender to the recipient's mail server is recorded along with the time of passage in the Received headers. Every time a Mail Transfer Agent (MTA) handles the message, it prepends a new Received line at the top of the headers.

By tracing this record in chronological order (from oldest to newest), you can estimate the delivery delay time (lag) between relay servers. However, it is fundamentally important to note that the oldest field at the bottom can be easily forged by attackers to create a false origin. Trust must be established by working backward from your known trusted receiving server (refer to RFC 8601 for concepts on trust boundaries). Furthermore, the IP address shown in these hops is not a proof of a specific person's identity, but merely the network address of the sending server. Also, adjacent positive timestamp differences are only estimates subject to clock drift; negative differences are clamped to 0 by our tool, and absent values do not prove there was no delay or guarantee safety.

② Security authentication result (SPF / DKIM / DMARC)

Modern email relies heavily on three typical authentication technologies to combat spoofing and unauthorized senders.

SPF (Sender Policy Framework): Verifies whether the email was sent from an IP address that has been explicitly authorized by the owner of the sender domain through DNS TXT records.
DKIM (DomainKeys Identified Mail): Verifies that the cryptographic electronic signature attached to the email matches the signing domain and the covered data (headers and body), ensuring it has not been tampered with in transit.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): Requires that either SPF OR DKIM successfully passes, and checks if that successfully authenticated domain aligns with the "From" domain shown to the user. Note that alignment conditions vary depending on the alignment policy (strict or relaxed).

Keep in mind that even if these checks authenticate with a "PASS" in the Authentication-Results header, it is not an absolute guarantee of safe content or that the sender is a trustworthy entity. An attacker can set up a valid domain and pass all these checks. There is also no automatic ARC (Authenticated Received Chain) rescue feature built into this analyzer that automatically overrides failures.

Privacy tips when analyzing headers

E-mail headers contain highly sensitive information, such as exact e-mail addresses, full names, internal IP addresses within your organization, proprietary server names, and sometimes even sensitive subject lines. Always follow your organization's compliance rules regarding privacy and data handling. It is highly recommended to minimize or mask sensitive headers before sharing them with any third parties or IT support, while keeping the original raw file completely safe and untouched for internal administrative review and forensic investigation.

§3. Tool-based solutions: Parsing headers with the ZeroTools email header analyzer

“I want to easily check delivery routes and certification status without specialized knowledge.”

Our site's Email header analysis tool provides a clean, accessible interface for decoding complex raw text into readable insights as a supplementary analysis tool.

This tool parses the header text directly within your browser environment. While the JavaScript parsing logic runs locally in the browser, please be aware that the site and its resources (such as fonts or analytics) may still communicate with servers for typical web functionality. Additionally, browser extensions you have installed may read page content. Therefore, we do not make absolute, blanket "leakage-zero", "complete-offline", or "GDPR-compliance" claims. It should be treated as an auxiliary diagnostic tool for your technical investigation workflow.

Information obtained from the analysis tool and how to use it

1. Open the Email header analysis tool page in your web browser.

2. Paste the raw source (header text) copied from your email software or use the file-picker button to load a .eml or .txt file directly (note that the tool requires text in header format; an arbitrary .txt file will not be meaningful). The interface does not support drag-and-drop functionality. For instructions on extracting headers, refer to the official help pages for Gmail or Outlook.

3. Once processed, the analysis provides several organized tabs: a general summary, authentication details (SPF/DKIM/DMARC), sequential routing hops, and a comprehensive list of all raw headers with searchable keys and values.

Authentication extraction: The tool searches the headers, combines Authentication-Results and ARC-Authentication-Results fields, and extracts the first matches for SPF, DKIM, and DMARC. It does this without identifying a trusted authserv-id or performing live DNS re-verification on the fly. The provenance of these results must be carefully checked in the raw text tab to ensure they were stamped by your trusted server, not forged by the sender.
Visual delivery route: The parsed Received hops are reversed and displayed chronologically from oldest (sender) to newest (receiver). The tool unfolds continued lines automatically, but basic fields remain in their raw format and do not undergo full MIME decoding (e.g., RFC 2047 encoded words).
Header list search function: You can instantly search and filter specific keywords or header names from the hundreds of lines of raw headers using the search box on the 'All headers' tab.

Expand your security investigation by checking the concrete provenance of the outputs rather than relying entirely on automated safety guarantees or graphical badges.