How do I see the headers of an email?

Save the message as a file (Gmail: "Download message" gives an .eml; Outlook: dragging the message to the desktop gives a .msg) and drop it here.

Is a message that fails SPF fraudulent?

Not necessarily. Automatic forwarding, a mailing list or a badly declared sending service make SPF fail on legitimate messages. It is a clue to weigh against the others, not a verdict.

Why is the DKIM signature not verified here?

It would require asking DNS for the sender's public key, that is, leaving the tab. Nothing leaves it: the result shown is the one the receiving server recorded when the message arrived.

Read the headers of an email

The headers of a message say which servers it went through, at what time, and what the receiving server checked. Drop the message: they are put back in order and explained line by line.

Or drop an .eml or a .msg here. Nothing is uploaded: the files stay in this tab.

When to use it

A message seems to come from your bank, a supplier or a colleague, and something feels off. Or a message arrived hours late, and you want to know where it waited.

The headers answer part of that, but they read from bottom to top, with times in several time zones and lines hundreds of characters long.

What this tool does

The route (Received) put back in order, from the first server to the last, with times brought to a single time zone and the time spent at each step.
The authentication results already recorded by the receiving server (Authentication-Results): SPF, DKIM, DMARC.
The message ID, the sending software, the reply-to and return addresses.
Inconsistencies, stated as observations with their possible innocent cause: a date later than receipt, times going backwards, an ID from a domain other than the sender's.
Every raw header, to copy as it is.

What it does not do: Nothing is checked live: the DKIM signature is not recomputed and no DNS query is made, since it would leave the tab. The results shown are those the receiving server recorded. Klarinbox says what it observes; it never says a message is fake or authentic.

What it reads

.eml and .emlx: every header, as received.
.msg: the headers Outlook kept. A message drafted and never sent has none.

No file is uploaded: the message is read by your browser, in this tab, and the page is not allowed to open a connection to any other site.

Frequently asked questions

How do I see the headers of an email?: Save the message as a file (Gmail: "Download message" gives an .eml; Outlook: dragging the message to the desktop gives a .msg) and drop it here.
Is a message that fails SPF fraudulent?: Not necessarily. Automatic forwarding, a mailing list or a badly declared sending service make SPF fail on legitimate messages. It is a clue to weigh against the others, not a verdict.
Why is the DKIM signature not verified here?: It would require asking DNS for the sender's public key, that is, leaving the tab. Nothing leaves it: the result shown is the one the receiving server recorded when the message arrived.

Other tools

Open a .msg file : An email saved from Outlook, read without Outlook: header, body, attachments.
Open an .eml file : The standard email format, and Apple Mail's .emlx: every encoding, every part.
Open a winmail.dat : The unreadable attachment Outlook sends: the real files inside come out.
Open a PST file : A whole Outlook mailbox (.pst, .ost): its folders, its messages, search and filters.
Open an mbox mailbox : An mbox mailbox (Gmail via Google Takeout, Thunderbird): labels, search, attachments.