> ## Documentation Index > Fetch the complete documentation index at: https://docs.iotools.cloud/llms.txt > Use this file to discover all available pages before exploring further. # Email Header Analyzer > Parse raw email headers to reveal the sender, the delivery hop chain with per-hop delays, SPF/DKIM/DMARC authentication results, spam-filter scores and every header grouped by purpose — all in your browser. [Try Email Header Analyzer in your browser →](https://iotools.cloud/tool/email-header-analyzer/) ## OpenAPI ````yaml https://api.iotools.cloud/v1/openapi post /v1/tool/email-header-analyzer openapi: 3.1.0 info: title: iotools.cloud API version: 1.0.0 description: >- Run any iotools.cloud tool over HTTP. Authenticate with `Authorization: Bearer iot_live_…`. **Only `POST /v1/tool/{slug}` costs credits.** Every GET here — the catalog, a tool's schema, your balance — is free. A tool call is charged its own weight or your plan's per-call minimum, whichever is larger; `x-iotools-credit-cost` on each operation is quoted at the free-tier minimum, and `GET /v1/tools/list` returns the exact figure for your key. `GET /v1/me/credits` reports what you have left, and `GET /v1/me/usage` reports what it went on. Failures are RFC 9457 problem documents — branch on `code`. servers: - url: https://api.iotools.cloud description: Production security: - bearerAuth: [] tags: - name: Catalog description: Find a tool and read its contract. Free. - name: Converters description: >- Convert between formats, encodings, and units — Base64, CSV and JSON, timestamps, and more. Fast, free, and processed right in your browser. - name: Formatters description: >- Format, beautify, minify, and validate code and data — JSON, HTML, CSS, SQL, and regex. Clean up messy input in one click, with nothing to upload. - name: Generators description: >- Generate exactly what you need and on demand — passwords, UUIDs, QR codes, hashes, random numbers, and more. Secure, instant, and free. - name: Calculators description: >- Crunch the numbers fast — from everyday math to specialized conversions and unit work. Free online calculators that run entirely in your browser. - name: Editors description: >- Edit and transform text, code, and images with quick, focused editors that run entirely in your browser — nothing to install, and no sign-up needed. - name: Utilities description: >- Everyday developer and web utilities — DNS and IP lookups, redirect and certificate checkers, and other quick diagnostics. Free and privacy-friendly. - name: Account description: Your key's allowance, limits and usage history. paths: /v1/tool/email-header-analyzer: post: tags: - Utilities summary: Email Header Analyzer description: >- Parse raw email headers to reveal the sender, the delivery hop chain with per-hop delays, SPF/DKIM/DMARC authentication results, spam-filter scores and every header grouped by purpose — all in your browser. [Try Email Header Analyzer in your browser →](https://iotools.cloud/tool/email-header-analyzer/) operationId: run_email_header_analyzer requestBody: required: false content: application/json: schema: type: object properties: rawHeaders: type: string description: Raw Email Headers required: [] examples: sample_email_all_checks_pass: summary: Sample email (all checks pass) value: rawHeaders: >- Delivered-To: recipient@example.com Received: by 2002:a05:6a20:918a:0:0:0:0 with SMTP id adf99e12a06e7-33f; Thu, 20 Mar 2026 08:15:32 -0700 (PDT) Received: from mail-sor-f41.google.com (mail-sor-f41.google.com [209.85.220.41]) by mx.google.com with SMTPS id a640c23a62f3a-ab6; Thu, 20 Mar 2026 08:15:30 -0700 (PDT) Received-SPF: pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41; Authentication-Results: mx.google.com; dkim=pass header.i=@example.org header.s=google header.b=abc123; spf=pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) smtp.mailfrom=sender@example.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.org Received: from webserver.example.org (webserver.example.org [203.0.113.50]) by mail-sor-f41.google.com with ESMTP id abc123; Thu, 20 Mar 2026 08:15:28 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by webserver.example.org (Postfix) with ESMTP id DEF456; Thu, 20 Mar 2026 08:14:45 -0700 (PDT) From: =?UTF-8?B?Sm9obiBEb2U=?= To: Jane Smith Subject: =?UTF-8?Q?Meeting_Tomorrow_=E2=80=93_Project_Update?= Date: Thu, 20 Mar 2026 08:14:44 -0700 Message-ID: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="000000000000abcdef" Content-Transfer-Encoding: 7bit X-Mailer: CustomMailer/2.1 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham X-Spam-Score: -2.1 spoofed_sender_spf_fail: summary: Spoofed sender (SPF fail) value: rawHeaders: >- From: "Your Bank" To: victim@example.com Subject: Urgent: verify your account Date: Mon, 01 Jun 2026 10:00:00 +0000 Authentication-Results: mx.example.com; spf=fail smtp.mailfrom=attacker@evil.example Message-ID: responses: '200': description: Tool output content: application/json: examples: sample_email_all_checks_pass: summary: Sample email (all checks pass) value: tool: email-header-analyzer tool_version: 1.0.1 outputs: summary: - field: From value: John Doe - field: To value: Jane Smith - field: Subject value: Meeting Tomorrow – Project Update - field: Date value: Thu, 20 Mar 2026 08:14:44 -0700 - field: Message-ID value: - field: Originating IP value: 127.0.0.1 - field: Authentication value: 'SPF: pass · DKIM: pass · DMARC: pass' - field: Total delivery time value: 47s auth: - check: SPF (Sender Policy Framework) result: pass details: >- The sending server is authorized to send email for this domain. Domain: sender@example.org - check: DKIM (DomainKeys Identified Mail) result: pass details: >- The email signature is valid and the message has not been altered in transit. Domain: example.org - check: DMARC (Domain-based Message Authentication) result: pass details: >- The email passes DMARC alignment (SPF and/or DKIM align with the From domain). Domain: example.org Policy: REJECT hops: - 'n': '1' from: localhost by: webserver.example.org time-utc: Fri, 20 Mar 2026 15:14:45 GMT delay: — - 'n': '2' from: webserver.example.org by: mail-sor-f41.google.com time-utc: Fri, 20 Mar 2026 15:15:28 GMT delay: 43s ⚠️ - 'n': '3' from: mail-sor-f41.google.com by: mx.google.com time-utc: Fri, 20 Mar 2026 15:15:30 GMT delay: 2s - 'n': '4' from: — by: 2002:a05:6a20:918a:0:0:0:0 time-utc: Fri, 20 Mar 2026 15:15:32 GMT delay: 2s spam: - metric: Risk Assessment value: Low - metric: Spam Status value: >- No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham - metric: Spam Score value: '-2.1' - metric: Required Score value: '5.0' - metric: SpamAssassin Tests value: >- BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS headers: - group: Routing header: Delivered-To value: recipient@example.com - group: Routing header: Received value: >- by 2002:a05:6a20:918a:0:0:0:0 with SMTP id adf99e12a06e7-33f; Thu, 20 Mar 2026 08:15:32 -0700 (PDT) - group: Routing header: Received value: >- from mail-sor-f41.google.com (mail-sor-f41.google.com [209.85.220.41]) by mx.google.com with SMTPS id a640c23a62f3a-ab6; Thu, 20 Mar 2026 08:15:30 -0700 (PDT) - group: Routing header: Received-SPF value: >- pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41; - group: Routing header: Received value: >- from webserver.example.org (webserver.example.org [203.0.113.50]) by mail-sor-f41.google.com with ESMTP id abc123; Thu, 20 Mar 2026 08:15:28 -0700 (PDT) - group: Routing header: Received value: >- from localhost (localhost [127.0.0.1]) by webserver.example.org (Postfix) with ESMTP id DEF456; Thu, 20 Mar 2026 08:14:45 -0700 (PDT) - group: Authentication header: Authentication-Results value: >- mx.google.com; dkim=pass header.i=@example.org header.s=google header.b=abc123; spf=pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) smtp.mailfrom=sender@example.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.org - group: Sender / Recipient header: From value: John Doe - group: Sender / Recipient header: To value: Jane Smith - group: Content header: Subject value: Meeting Tomorrow – Project Update - group: Content header: Date value: Thu, 20 Mar 2026 08:14:44 -0700 - group: Content header: Message-ID value: - group: Content header: MIME-Version value: '1.0' - group: Content header: Content-Type value: multipart/alternative; boundary="000000000000abcdef" - group: Content header: Content-Transfer-Encoding value: 7bit - group: Custom / X-Headers header: X-Mailer value: CustomMailer/2.1 - group: Custom / X-Headers header: X-Spam-Status value: >- No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham - group: Custom / X-Headers header: X-Spam-Score value: '-2.1' credits_used: 3 credits_remaining: null spoofed_sender_spf_fail: summary: Spoofed sender (SPF fail) value: tool: email-header-analyzer tool_version: 1.0.1 outputs: summary: - field: From value: '"Your Bank" ' - field: To value: victim@example.com - field: Subject value: 'Urgent: verify your account' - field: Date value: Mon, 01 Jun 2026 10:00:00 +0000 - field: Message-ID value: - field: Originating IP value: Not detected - field: Authentication value: 'SPF: fail · DKIM: none · DMARC: none' auth: - check: SPF (Sender Policy Framework) result: fail details: >- The sending server is NOT authorized. This email may be spoofed. Domain: attacker@evil.example - check: DKIM (DomainKeys Identified Mail) result: none details: No DKIM record found in headers. - check: DMARC (Domain-based Message Authentication) result: none details: No DMARC record found in headers. hops: [] spam: [] headers: - group: Authentication header: Authentication-Results value: >- mx.example.com; spf=fail smtp.mailfrom=attacker@evil.example - group: Sender / Recipient header: From value: '"Your Bank" ' - group: Sender / Recipient header: To value: victim@example.com - group: Content header: Subject value: 'Urgent: verify your account' - group: Content header: Date value: Mon, 01 Jun 2026 10:00:00 +0000 - group: Content header: Message-ID value: credits_used: 3 credits_remaining: null schema: type: object required: - tool - tool_version - outputs - credits_used - credits_remaining properties: outputs: type: object properties: summary: type: array items: type: object properties: field: type: string description: Field value: type: string description: Value x-iotools-columns: - field - value auth: type: array items: type: object properties: check: type: string description: Check result: type: string description: Result details: type: string description: Details x-iotools-columns: - check - result - details hops: type: array items: type: object properties: 'n': type: string description: '#' from: type: string description: From by: type: string description: By time-utc: type: string description: Time (UTC) delay: type: string description: Delay x-iotools-columns: - 'n' - from - by - time-utc - delay spam: type: array items: type: object properties: metric: type: string description: Metric value: type: string description: Value x-iotools-columns: - metric - value headers: type: array items: type: object properties: group: type: string description: Group header: type: string description: Header value: type: string description: Value x-iotools-columns: - group - header - value tool: type: string description: The tool's slug, echoing the {slug} in the request path. tool_version: type: string description: Output-contract version for this tool. credits_used: type: integer description: >- Credits this call consumed, after any settlement refund. 0 when metering is disabled. credits_remaining: type: - integer - 'null' description: >- Credits left in the current monthly allowance, or null when metering is disabled. request_id: type: string description: Correlation id, also sent as x-request-id. '400': $ref: '#/components/responses/ValidationError' '401': $ref: '#/components/responses/Unauthorized' '402': $ref: '#/components/responses/InsufficientCredits' '403': $ref: '#/components/responses/ToolNotAllowed' '404': $ref: '#/components/responses/ToolNotFound' '413': $ref: '#/components/responses/PayloadTooLarge' '429': $ref: '#/components/responses/RateLimited' '500': $ref: '#/components/responses/ToolFailed' '503': $ref: '#/components/responses/ToolDisabled' security: - bearerAuth: [] components: responses: ValidationError: description: Invalid request. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/validation_error title: type: string description: Short human-readable summary of the failure. examples: - Invalid request status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - validation_error detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. fields: type: - object - string additionalProperties: type: string description: >- What failed: a map of field name → message. Absent when the body itself is malformed; a single string when the failure isn't tied to one field. example: type: https://iotools.cloud/docs/errors/validation_error title: Invalid request status: 400 code: validation_error detail: One or more inputs are invalid — see `fields`. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 fields: inputString: Required Unauthorized: description: Missing or invalid API key. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/invalid_api_key title: type: string description: Short human-readable summary of the failure. examples: - Invalid API key status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - invalid_api_key detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. example: type: https://iotools.cloud/docs/errors/invalid_api_key title: Invalid API key status: 401 code: invalid_api_key detail: 'Provide ''Authorization: Bearer ''.' request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 InsufficientCredits: description: Monthly credit allowance exhausted. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/insufficient_credits title: type: string description: Short human-readable summary of the failure. examples: - Insufficient credits status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - insufficient_credits detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. credits_used: type: integer description: Always 0 — a refused call charges nothing. credits_remaining: type: integer description: Credits left in the allowance — fewer than this call costs. example: type: https://iotools.cloud/docs/errors/insufficient_credits title: Insufficient credits status: 402 code: insufficient_credits detail: This call costs 1 credit and 0 remain in this month's allowance. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 credits_used: 0 credits_remaining: 0 ToolNotAllowed: description: Tool exists but has no API surface. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/tool_not_allowed title: type: string description: Short human-readable summary of the failure. examples: - Tool not available over the API status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - tool_not_allowed detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. example: type: https://iotools.cloud/docs/errors/tool_not_allowed title: Tool not available over the API status: 403 code: tool_not_allowed detail: >- "Background Remover" is available on iotools.cloud but has no API endpoint. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 ToolNotFound: description: No such tool. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/tool_not_found title: type: string description: Short human-readable summary of the failure. examples: - Tool not found status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - tool_not_found detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. example: type: https://iotools.cloud/docs/errors/tool_not_found title: Tool not found status: 404 code: tool_not_found detail: No tool with that slug. See GET /v1/tools/list. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 PayloadTooLarge: description: Body too large. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/payload_too_large title: type: string description: Short human-readable summary of the failure. examples: - Payload too large status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - payload_too_large detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. example: type: https://iotools.cloud/docs/errors/payload_too_large title: Payload too large status: 413 code: payload_too_large detail: Request body exceeds this tool's size limit. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 RateLimited: description: Per-minute rate limit exceeded. headers: Retry-After: description: Seconds to wait before retrying (RFC 9110 delta-seconds). schema: type: integer content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/rate_limited title: type: string description: Short human-readable summary of the failure. examples: - Rate limit exceeded status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - rate_limited detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. retry_after: type: integer description: >- Seconds until the window resets — the same value as the `Retry-After` header. example: type: https://iotools.cloud/docs/errors/rate_limited title: Rate limit exceeded status: 429 code: rate_limited detail: Too many requests. Retry in 30s. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 retry_after: 30 ToolFailed: description: Tool failed to run. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/processing_error - https://iotools.cloud/docs/errors/internal_error title: type: string description: Short human-readable summary of the failure. examples: - Tool failed to run - Internal error status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - processing_error - internal_error detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. credits_used: type: integer description: >- Always 0 on `processing_error` — a failed run is refunded, floor included. credits_remaining: type: integer description: >- Credits left after the refund. Absent when metering is disabled. example: type: https://iotools.cloud/docs/errors/processing_error title: Tool failed to run status: 500 code: processing_error detail: The tool failed to run. Please try again. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 credits_used: 0 ToolDisabled: description: Tool temporarily disabled. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/tool_disabled - https://iotools.cloud/docs/errors/api_unconfigured title: type: string description: Short human-readable summary of the failure. examples: - Tool temporarily disabled - API not configured status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - tool_disabled - api_unconfigured detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. example: type: https://iotools.cloud/docs/errors/tool_disabled title: Tool temporarily disabled status: 503 code: tool_disabled detail: This tool is temporarily unavailable. Try again shortly. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: iot_live_… ````