✉️EML Tool
EML Tools
EML ViewerEML to HTMLEML to CSVEML to PDFEMLX ViewerMBOX ViewerMSG ViewerMSG File ViewerMSG to EMLOpen MSG FileWinmail.dat OpenerEML HeadersBatch EML to PDF (Pro)

Inspect EML and message headers

Paste a header block or drop an .eml to see the Received chain, Return-Path, and the SPF / DKIM / DMARC stamps — locally, in the browser. This is a reading aid for a file you already have, not a replacement for MxToolbox-class live DNS lookups.

✉️
Written by Casey Marlin · Last updated
This update: header unfolding and Authentication-Results parsing checked against RFC 5322 samples and Gmail Show original copies

Paste headers, or drop an .eml

Gmail: three dots → Show original → copy the header block. Nothing is uploaded.

How to read the Received chain

Each Received line is one mail server that handled the message. The file lists them newest first; read from the bottom up to follow the path from the sending host to your inbox. A hop that appears only at the top and does not match the others is the usual place to start when the From address looks forged.

The same .eml also has a body and attachments. After you have looked at the headers, open the file in the EML viewer to read the message. What each field means in the format itself is on What is an EML file?.

How to inspect message headers from an EML file

Drop the .eml on this page, or paste the header block from Gmail → Show original. The inspector unfolds RFC 5322 lines, lists Received hops newest first, and reads SPF, DKIM and DMARC out of Authentication-Results. Nothing is uploaded. The homepage EML viewer has a Headers tab on an opened message that uses the same parser.

SPF, DKIM and DMARC on this copy

Authentication-Results is a stamp added by the server that received the message, not by the sender. A DKIM pass means the signed headers and body were not altered after signing. This page reports that stamp; it does not query DNS itself. If the header is missing, this copy never went through a server that writes one — common on saved drafts and on .msg files rebuilt without the original transport headers.

FAQ

Are the headers uploaded?
No. Parsing runs in this tab. After the page has loaded you can disconnect the network. There is no analysis server and no account.
Where do I copy headers in Gmail?
Open the message → the three-dot menu → Show original. Copy from the first Received line down to the blank line before the body, or download the .eml and drop that file on this page.
Does this prove an email is authentic?
It shows what this copy of the message claims: the hop list and the Authentication-Results stamp added by the receiving server. A DKIM pass means those signed fields were not altered after signing. It does not replace a full forensic review, and it cannot recover hops that were never written into this file.
Why is the Received chain empty on an Outlook .msg?
A .msg rebuilt in the browser does not carry the original Received headers. Save or download the message as .eml, or paste the header block from the mail system that received it.
From and Return-Path don't match. Is that spoofing?
Not by itself. Newsletters and mailing lists almost always bounce to a different envelope sender. On a supposed personal message it is a reason to look at SPF/DKIM next, not a verdict on its own.

Related tools