See who really sent that email
Paste the raw headers and get the sender, the recipients, the full relay path, the SPF/DKIM/DMARC verdict, and the exact IP addresses worth investigating — with an honest note on what the evidence does and does not prove.
What you get
Sender and recipients
From, To, Cc, Bcc, Reply-To, Return-Path and Sender, with encoded names decoded.
Relay timeline
Every hop in order, with timestamps, time zones and the delay between each one.
Authentication
SPF, DKIM and DMARC, each explained with what it proves and where it falls short.
Source IP candidates
A ranked table with confidence, public/private classification, reverse DNS and network owner. Copy any row or the whole list.
Before you block anything
- The first IP is not automatically the sender. Headers added before the message reached a server you trust can be forged.
- The top-most Received header is the one your own mail server wrote — that is the only one guaranteed genuine.
- An IP identifies a connection, not a person. VPNs, mobile networks, shared hosting and legitimate relays serve thousands of unrelated users.
- Blocking a big provider's range can silently stop real mail. Prefer the abuse contact shown for the network.
- This tool never blocks, reports or modifies anything. It only reads what you paste.
Privacy
Your pasted headers are parsed on this server and are not stored. If you tick the lookup option, only the public IP addresses and domain names found in the headers are sent to external services (RDAP registry data and public DNS) to fetch ownership and mail-routing details. The body of your email, its subject and the addresses themselves are never sent anywhere.