Clue Tools
Header Scanner

Find out where an email really came from.

Web tool Nothing to install No account
  • Every server on the route, with its country
  • SPF, DKIM and DMARC results explained
  • Locates any list of IP addresses
or any text containing IP addresses

The sample is a real message header. One click loads it and shows the full result, so you can see what the analyzer does before pasting your own.

Every hop, locatedEach server that handled the message, with its address and country.
The codes, explainedSPF, DKIM, DMARC and the other fields, in plain words on hover.
No account, nothing to installPaste, click, read. Works in any browser.
A sign-up form marked as not needed, and the analyzer ready to use in the browser
No account

No account. Nothing to install.

There is nothing to register and nothing to sign in to. Paste a header, click Analyze and read the result, in any browser.

How it works

Paste, click, read

Three steps, in any browser, with nothing to install and no account.

A mail program with its message menu open at Show original
1

Copy the header

Open the original message or its headers in your mail program. The list at the top of this page shows where to find them.

Header lines pasted into the box, and the Analyze Email Header button
2

Paste it and analyze

Paste the header into the box and click Analyze Email Header. No header to hand? Analyze the sample.

Three numbered servers, each with its country, leading to the inbox
3

Read the route

Every server the message passed through, oldest first, each with its location and network, and the authentication results.

An email passing three numbered servers, each with its host name, address and country, then delivered
What it tells you

The path a message took

An email header is the message’s travel record. Each server that handled it adds a line, newest at the top. Reading those lines shows where the message entered the mail system, which services relayed it, and whether the sending server was authorized to send for the domain it claims.

Use it to check

  • A message that looks like it came from your bank but was sent from somewhere else.
  • Whether SPF and DKIM passed, and what a failure means for that message.
  • Where a sender’s mail app connected from, by country and network.
  • Any list of IP addresses from a log or a report, located in one go.

A plausible path is evidence, not proof: a forged message can still carry a convincing header. Read the result together with the authentication fields.

SPF, DKIM and DMARC results, each passed, with a note explaining DKIM in plain words
Authentication

SPF, DKIM and DMARC results explained

Whether the sending server was authorized for the domain it claims, and whether the message changed after it was signed. Each field is explained in plain words, shown when you hover over it.

IP addresses picked out of a log, each located with its country, city and network
IP addresses

Locates any list of IP addresses

Paste a log, a report or any text that contains IP addresses, and every address is located in one go, each with its location, flag and network.

The header stays in the browser window; only two IP addresses go to this server, for a location lookup
What this site processes

The header stays in your browser

The analysis runs on this page. Only the IP addresses found in the text are sent to this server, to be located with a geolocation database held here. Each use of a tool is recorded with the time and the address it came from, so the service can be monitored. The privacy notice has the details.

Also on this site

Small tools for the same job

FAQ

Frequently asked questions

Can the header tell me who sent the message?
It tells you which servers handled it and where they are, and whether the sending server was authorized for the domain it claims. That is usually enough to tell a genuine message from a forged one, but it identifies networks and services, not a person.
Why does the location show a mail provider rather than the sender?
A message sent through webmail in a browser usually records the provider’s address, not the writer’s. A message sent from a mail app on a phone or PC usually records that device’s address, which can place it by country and sometimes by city.
What does an SPF or DKIM failure mean?
That the sending server was not authorized for the domain (SPF), or that the message changed after it was signed or the signature could not be checked (DKIM). Both are strong signs of forgery, with the exception of a domain owner who has misconfigured their own records. The header codes page explains each value.
Is the text I paste stored?
The header is read in your browser. Only the IP addresses found in it are sent to the server to be located, and each lookup is recorded with the time and the address it came from. Nothing else from the header is sent.
Does it work for any mail provider?
Yes. Headers follow the same standard everywhere. The way to display a header differs by mail program; the list under the box covers the common ones.

Have a message you are not sure about?

Paste its header at the top of this page and see the route it took.

The rest of the family

More tools, built to the same standard

Each one does a single job properly, in the same plain language, with no account anywhere.

File Sender

filesender.io
Web and Windows appNo account

Send a file from the browser, encrypted before it is uploaded, or use the Windows application for larger files and whole folders.

Visit filesender.io →

TextMe.im

textme.im
Web toolNo account

Send a private message as a link that can be opened once and then disappears. No account and no phone number.

Visit textme.im →

Protected Chat

protected.chat
Web toolNo account

A one-time encrypted conversation that opens from a link. No account, no phone number and no history kept.

Visit protected.chat →

MyPC.direct

mypc.direct
Windows appNo account

Reach your own PC from anywhere over a direct, encrypted channel between the two machines, using credentials of your own choosing, with no provider or service in the middle.

Visit mypc.direct →

Sending.Pics

sending.pics
Windows appFree for personal use

Hand a whole gallery of photos and videos to family directly from your computer, using one-time codes that expire on their own and can be revoked at any moment.

Visit sending.pics →

Claim Disk

claimdisk.com
Windows appFree for personal use

Reads the drive’s own file table instead of walking folders, so the whole disk appears quickly, sorted by size. Delete, move and rename from the same window, with a running total of the space reclaimed.

Visit claimdisk.com →

LAN Fixer

lanfixer.com
Windows appFree for home use

Shows the devices on your network in about thirty seconds, explains in plain English what is wrong, and fixes it in one click — with a link straight to your own router’s security advisories and firmware.

Visit lanfixer.com →

Map Blocker

mapblocker.com
Windows appFree for personal use

Draws the connections your PC makes on a map of the world, shows which program made it, and blocks any address, region or whole country that has no business being there.

Visit mapblocker.com →

Free for personal use, all of them. Organizational use (business, government and non-profit) of the Windows applications starts at $19.99 per seat.