curl --request POST \
--url https://api.iotools.cloud/v1/tool/email-header-analyzer \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"rawHeaders": "Delivered-To: recipient@example.com\nReceived: by 2002:a05:6a20:918a:0:0:0:0 with SMTP id adf99e12a06e7-33f; Thu, 20 Mar 2026 08:15:32 -0700 (PDT)\nReceived: from mail-sor-f41.google.com (mail-sor-f41.google.com [209.85.220.41]) by mx.google.com with SMTPS id a640c23a62f3a-ab6; Thu, 20 Mar 2026 08:15:30 -0700 (PDT)\nReceived-SPF: pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;\nAuthentication-Results: mx.google.com; dkim=pass header.i=@example.org header.s=google header.b=abc123; spf=pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) smtp.mailfrom=sender@example.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.org\nReceived: from webserver.example.org (webserver.example.org [203.0.113.50]) by mail-sor-f41.google.com with ESMTP id abc123; Thu, 20 Mar 2026 08:15:28 -0700 (PDT)\nReceived: from localhost (localhost [127.0.0.1]) by webserver.example.org (Postfix) with ESMTP id DEF456; Thu, 20 Mar 2026 08:14:45 -0700 (PDT)\nFrom: =?UTF-8?B?Sm9obiBEb2U=?= <sender@example.org>\nTo: Jane Smith <recipient@example.com>\nSubject: =?UTF-8?Q?Meeting_Tomorrow_=E2=80=93_Project_Update?=\nDate: Thu, 20 Mar 2026 08:14:44 -0700\nMessage-ID: <CAExample123@mail.example.org>\nMIME-Version: 1.0\nContent-Type: multipart/alternative; boundary=\"000000000000abcdef\"\nContent-Transfer-Encoding: 7bit\nX-Mailer: CustomMailer/2.1\nX-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham\nX-Spam-Score: -2.1"
}
'{
"tool": "email-header-analyzer",
"tool_version": "1.0.1",
"outputs": {
"summary": [
{
"field": "From",
"value": "John Doe <sender@example.org>"
},
{
"field": "To",
"value": "Jane Smith <recipient@example.com>"
},
{
"field": "Subject",
"value": "Meeting Tomorrow – Project Update"
},
{
"field": "Date",
"value": "Thu, 20 Mar 2026 08:14:44 -0700"
},
{
"field": "Message-ID",
"value": "<CAExample123@mail.example.org>"
},
{
"field": "Originating IP",
"value": "127.0.0.1"
},
{
"field": "Authentication",
"value": "SPF: pass · DKIM: pass · DMARC: pass"
},
{
"field": "Total delivery time",
"value": "47s"
}
],
"auth": [
{
"check": "SPF (Sender Policy Framework)",
"result": "pass",
"details": "The sending server is authorized to send email for this domain. Domain: sender@example.org"
},
{
"check": "DKIM (DomainKeys Identified Mail)",
"result": "pass",
"details": "The email signature is valid and the message has not been altered in transit. Domain: example.org"
},
{
"check": "DMARC (Domain-based Message Authentication)",
"result": "pass",
"details": "The email passes DMARC alignment (SPF and/or DKIM align with the From domain). Domain: example.org Policy: REJECT"
}
],
"hops": [
{
"n": "1",
"from": "localhost",
"by": "webserver.example.org",
"time-utc": "Fri, 20 Mar 2026 15:14:45 GMT",
"delay": "—"
},
{
"n": "2",
"from": "webserver.example.org",
"by": "mail-sor-f41.google.com",
"time-utc": "Fri, 20 Mar 2026 15:15:28 GMT",
"delay": "43s ⚠️"
},
{
"n": "3",
"from": "mail-sor-f41.google.com",
"by": "mx.google.com",
"time-utc": "Fri, 20 Mar 2026 15:15:30 GMT",
"delay": "2s"
},
{
"n": "4",
"from": "—",
"by": "2002:a05:6a20:918a:0:0:0:0",
"time-utc": "Fri, 20 Mar 2026 15:15:32 GMT",
"delay": "2s"
}
],
"spam": [
{
"metric": "Risk Assessment",
"value": "Low"
},
{
"metric": "Spam Status",
"value": "No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham"
},
{
"metric": "Spam Score",
"value": "-2.1"
},
{
"metric": "Required Score",
"value": "5.0"
},
{
"metric": "SpamAssassin Tests",
"value": "BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS"
}
],
"headers": [
{
"group": "Routing",
"header": "Delivered-To",
"value": "recipient@example.com"
},
{
"group": "Routing",
"header": "Received",
"value": "by 2002:a05:6a20:918a:0:0:0:0 with SMTP id adf99e12a06e7-33f; Thu, 20 Mar 2026 08:15:32 -0700 (PDT)"
},
{
"group": "Routing",
"header": "Received",
"value": "from mail-sor-f41.google.com (mail-sor-f41.google.com [209.85.220.41]) by mx.google.com with SMTPS id a640c23a62f3a-ab6; Thu, 20 Mar 2026 08:15:30 -0700 (PDT)"
},
{
"group": "Routing",
"header": "Received-SPF",
"value": "pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;"
},
{
"group": "Routing",
"header": "Received",
"value": "from webserver.example.org (webserver.example.org [203.0.113.50]) by mail-sor-f41.google.com with ESMTP id abc123; Thu, 20 Mar 2026 08:15:28 -0700 (PDT)"
},
{
"group": "Routing",
"header": "Received",
"value": "from localhost (localhost [127.0.0.1]) by webserver.example.org (Postfix) with ESMTP id DEF456; Thu, 20 Mar 2026 08:14:45 -0700 (PDT)"
},
{
"group": "Authentication",
"header": "Authentication-Results",
"value": "mx.google.com; dkim=pass header.i=@example.org header.s=google header.b=abc123; spf=pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) smtp.mailfrom=sender@example.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.org"
},
{
"group": "Sender / Recipient",
"header": "From",
"value": "John Doe <sender@example.org>"
},
{
"group": "Sender / Recipient",
"header": "To",
"value": "Jane Smith <recipient@example.com>"
},
{
"group": "Content",
"header": "Subject",
"value": "Meeting Tomorrow – Project Update"
},
{
"group": "Content",
"header": "Date",
"value": "Thu, 20 Mar 2026 08:14:44 -0700"
},
{
"group": "Content",
"header": "Message-ID",
"value": "<CAExample123@mail.example.org>"
},
{
"group": "Content",
"header": "MIME-Version",
"value": "1.0"
},
{
"group": "Content",
"header": "Content-Type",
"value": "multipart/alternative; boundary=\"000000000000abcdef\""
},
{
"group": "Content",
"header": "Content-Transfer-Encoding",
"value": "7bit"
},
{
"group": "Custom / X-Headers",
"header": "X-Mailer",
"value": "CustomMailer/2.1"
},
{
"group": "Custom / X-Headers",
"header": "X-Spam-Status",
"value": "No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham"
},
{
"group": "Custom / X-Headers",
"header": "X-Spam-Score",
"value": "-2.1"
}
]
},
"credits_used": 3,
"credits_remaining": null
}Utilities
Email Header Analyzer
Parse raw email headers to reveal the sender, the delivery hop chain with per-hop delays, SPF/DKIM/DMARC authentication results, spam-filter scores and every header grouped by purpose — all in your browser.
POST
/
v1
/
tool
/
email-header-analyzer
curl --request POST \
--url https://api.iotools.cloud/v1/tool/email-header-analyzer \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"rawHeaders": "Delivered-To: recipient@example.com\nReceived: by 2002:a05:6a20:918a:0:0:0:0 with SMTP id adf99e12a06e7-33f; Thu, 20 Mar 2026 08:15:32 -0700 (PDT)\nReceived: from mail-sor-f41.google.com (mail-sor-f41.google.com [209.85.220.41]) by mx.google.com with SMTPS id a640c23a62f3a-ab6; Thu, 20 Mar 2026 08:15:30 -0700 (PDT)\nReceived-SPF: pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;\nAuthentication-Results: mx.google.com; dkim=pass header.i=@example.org header.s=google header.b=abc123; spf=pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) smtp.mailfrom=sender@example.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.org\nReceived: from webserver.example.org (webserver.example.org [203.0.113.50]) by mail-sor-f41.google.com with ESMTP id abc123; Thu, 20 Mar 2026 08:15:28 -0700 (PDT)\nReceived: from localhost (localhost [127.0.0.1]) by webserver.example.org (Postfix) with ESMTP id DEF456; Thu, 20 Mar 2026 08:14:45 -0700 (PDT)\nFrom: =?UTF-8?B?Sm9obiBEb2U=?= <sender@example.org>\nTo: Jane Smith <recipient@example.com>\nSubject: =?UTF-8?Q?Meeting_Tomorrow_=E2=80=93_Project_Update?=\nDate: Thu, 20 Mar 2026 08:14:44 -0700\nMessage-ID: <CAExample123@mail.example.org>\nMIME-Version: 1.0\nContent-Type: multipart/alternative; boundary=\"000000000000abcdef\"\nContent-Transfer-Encoding: 7bit\nX-Mailer: CustomMailer/2.1\nX-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham\nX-Spam-Score: -2.1"
}
'{
"tool": "email-header-analyzer",
"tool_version": "1.0.1",
"outputs": {
"summary": [
{
"field": "From",
"value": "John Doe <sender@example.org>"
},
{
"field": "To",
"value": "Jane Smith <recipient@example.com>"
},
{
"field": "Subject",
"value": "Meeting Tomorrow – Project Update"
},
{
"field": "Date",
"value": "Thu, 20 Mar 2026 08:14:44 -0700"
},
{
"field": "Message-ID",
"value": "<CAExample123@mail.example.org>"
},
{
"field": "Originating IP",
"value": "127.0.0.1"
},
{
"field": "Authentication",
"value": "SPF: pass · DKIM: pass · DMARC: pass"
},
{
"field": "Total delivery time",
"value": "47s"
}
],
"auth": [
{
"check": "SPF (Sender Policy Framework)",
"result": "pass",
"details": "The sending server is authorized to send email for this domain. Domain: sender@example.org"
},
{
"check": "DKIM (DomainKeys Identified Mail)",
"result": "pass",
"details": "The email signature is valid and the message has not been altered in transit. Domain: example.org"
},
{
"check": "DMARC (Domain-based Message Authentication)",
"result": "pass",
"details": "The email passes DMARC alignment (SPF and/or DKIM align with the From domain). Domain: example.org Policy: REJECT"
}
],
"hops": [
{
"n": "1",
"from": "localhost",
"by": "webserver.example.org",
"time-utc": "Fri, 20 Mar 2026 15:14:45 GMT",
"delay": "—"
},
{
"n": "2",
"from": "webserver.example.org",
"by": "mail-sor-f41.google.com",
"time-utc": "Fri, 20 Mar 2026 15:15:28 GMT",
"delay": "43s ⚠️"
},
{
"n": "3",
"from": "mail-sor-f41.google.com",
"by": "mx.google.com",
"time-utc": "Fri, 20 Mar 2026 15:15:30 GMT",
"delay": "2s"
},
{
"n": "4",
"from": "—",
"by": "2002:a05:6a20:918a:0:0:0:0",
"time-utc": "Fri, 20 Mar 2026 15:15:32 GMT",
"delay": "2s"
}
],
"spam": [
{
"metric": "Risk Assessment",
"value": "Low"
},
{
"metric": "Spam Status",
"value": "No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham"
},
{
"metric": "Spam Score",
"value": "-2.1"
},
{
"metric": "Required Score",
"value": "5.0"
},
{
"metric": "SpamAssassin Tests",
"value": "BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS"
}
],
"headers": [
{
"group": "Routing",
"header": "Delivered-To",
"value": "recipient@example.com"
},
{
"group": "Routing",
"header": "Received",
"value": "by 2002:a05:6a20:918a:0:0:0:0 with SMTP id adf99e12a06e7-33f; Thu, 20 Mar 2026 08:15:32 -0700 (PDT)"
},
{
"group": "Routing",
"header": "Received",
"value": "from mail-sor-f41.google.com (mail-sor-f41.google.com [209.85.220.41]) by mx.google.com with SMTPS id a640c23a62f3a-ab6; Thu, 20 Mar 2026 08:15:30 -0700 (PDT)"
},
{
"group": "Routing",
"header": "Received-SPF",
"value": "pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;"
},
{
"group": "Routing",
"header": "Received",
"value": "from webserver.example.org (webserver.example.org [203.0.113.50]) by mail-sor-f41.google.com with ESMTP id abc123; Thu, 20 Mar 2026 08:15:28 -0700 (PDT)"
},
{
"group": "Routing",
"header": "Received",
"value": "from localhost (localhost [127.0.0.1]) by webserver.example.org (Postfix) with ESMTP id DEF456; Thu, 20 Mar 2026 08:14:45 -0700 (PDT)"
},
{
"group": "Authentication",
"header": "Authentication-Results",
"value": "mx.google.com; dkim=pass header.i=@example.org header.s=google header.b=abc123; spf=pass (google.com: domain of sender@example.org designates 209.85.220.41 as permitted sender) smtp.mailfrom=sender@example.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.org"
},
{
"group": "Sender / Recipient",
"header": "From",
"value": "John Doe <sender@example.org>"
},
{
"group": "Sender / Recipient",
"header": "To",
"value": "Jane Smith <recipient@example.com>"
},
{
"group": "Content",
"header": "Subject",
"value": "Meeting Tomorrow – Project Update"
},
{
"group": "Content",
"header": "Date",
"value": "Thu, 20 Mar 2026 08:14:44 -0700"
},
{
"group": "Content",
"header": "Message-ID",
"value": "<CAExample123@mail.example.org>"
},
{
"group": "Content",
"header": "MIME-Version",
"value": "1.0"
},
{
"group": "Content",
"header": "Content-Type",
"value": "multipart/alternative; boundary=\"000000000000abcdef\""
},
{
"group": "Content",
"header": "Content-Transfer-Encoding",
"value": "7bit"
},
{
"group": "Custom / X-Headers",
"header": "X-Mailer",
"value": "CustomMailer/2.1"
},
{
"group": "Custom / X-Headers",
"header": "X-Spam-Status",
"value": "No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham"
},
{
"group": "Custom / X-Headers",
"header": "X-Spam-Score",
"value": "-2.1"
}
]
},
"credits_used": 3,
"credits_remaining": null
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
application/json
Raw Email Headers
Response
Tool output
Show child attributes
Show child attributes
The tool's slug, echoing the {slug} in the request path.
Output-contract version for this tool.
Credits this call consumed, after any settlement refund. 0 when metering is disabled.
Credits left in the current monthly allowance, or null when metering is disabled.
Correlation id, also sent as x-request-id.
Was this page helpful?
⌘I