Back to Toolkit

Email Header Analysis

Deconstruct and analyze email headers to uncover the technical journey and potential spoofing indicators of any message.

1 Paste Headers

2 Analyze

3 View Results

Paste Email Headers Try sample headers

How to Get Headers

Sorb Security

Open the Admin Portal
Go to Message Trace, Mail Query, then Email Lifecycle
Click the icon on the message

Gmail

Open the email message
Click the three dots ⋮ menu
Select "Show original"
Copy the full header text

Outlook

Open the email, click File > Properties
Or double-click the message
Go to File > Properties
Copy from "Internet headers" box

Apple Mail

Open the email message
Go to View > Message > All Headers
Or press ⌘⇧H
Select all and copy

What We Analyze

Sender verification — SPF, DKIM, and DMARC authentication status
Routing path — every server hop with timestamps and delays
Threat indicators — spoofing, phishing signals, and reputation data
Loop detection — identifies mail routing loops automatically

What you'll get

Auth Status

SPF, DKIM, DMARC

Hop Trace

Full routing path

Threat Level

Risk assessment

Reputation

Talos, MX, VT links