Free browser tools
Email Header Analyzer
Read the mail route and authentication claims in an email header. Use an original EML file for a local DKIM body-hash comparison, then download the report.
Your files stay on your computer.
GDF Free Tools analyze files and email headers in your browser on your own computer. Your selected files, pasted headers and extracted results are not uploaded to GDF or an outside analysis service. The page and parser download to your browser; inspection runs locally.
No account or email address is needed to inspect an input or download its report. Reports may contain private information, so review them before sharing.
Using the results in forensic work
Use a working copy for inspection and preserve the original evidence. The report records the inspected input hash, inspection time and tool version so you can document what you examined. Check important findings and the tool’s limits as part of your examination. Metadata and email headers alone do not establish authenticity.
The inspection time comes from your browser’s clock; it is not an independently verified timestamp.
Analyze your email headers
Processed on your device. Your input is not uploaded. Optional usage measurement stays off unless you allow Analytics. It sends GDF only the tool name and fixed action labels, such as analysis completed or report prepared. No input, result, filename or visitor identifier is sent. Google and advertising scripts do not load on this page. Use Cookie settings below to change your choice. Clear removes the selected input and results from this page; it does not erase downloads you save.
Maximum 256 KiB. In Gmail, use Show original. In Outlook, open the message properties or view message details. Paste the header fields, not a screenshot.
Maximum 10 MiB. Selecting a file clears pasted text, and entering text clears the file selection. No MSG or MBOX support in this tool.
Choose a file or try the sample.
What this analyzer checks
- Recorded route: Received headers, server names, visible IP addresses and recorded dates, with the newest hop first.
- Authentication claims: supported SPF, DKIM and DMARC results reported in Authentication-Results fields. These remain parsed claims.
- DKIM body hash: supported SHA-256 body-hash comparisons from a complete EML file, with canonicalization and partial-body limits reported separately.
- Input hash: SHA-256 of the original selected file bytes or the pasted text encoded as UTF-8, clearly identified.
Save the results as PDF, CSV, HTML or JSON. The report exports extracted header fields, not the email body or attachments. Each export states any limits or omissions.
What it cannot establish
A pasted “pass” does not verify a sender. Authentication-Results fields can be forged, and trust depends on how the message was received and preserved.
A local DKIM body-hash match does not verify the public-key signature. This tool does not recheck SPF, retrieve DNS keys, validate DMARC alignment or locate a sender. Header-only input cannot check a message body.
Server names, addresses and dates describe the supplied records. They can be incomplete or altered. Different server clocks can also make a route appear out of order.
The methods are described in RFC 8601, RFC 6376 and RFC 9989.
Professional review
Need help with a disputed email?
Describe the question and deadline. An examiner can discuss the available records and a secure way to share them. This tool does not attach your input or report to an inquiry.
Version 1.0.0. Email Header Analyzer is free to use. Browse free tools.