Parse email header

Turn an Internet email header block into structured fields while retaining repeated transfer records.

freeworks offlinenothing uploaded
ToolEmail Header Parser
Input
Output
—

How it works

Parsing stops at the first empty line, normalises case-insensitive field names to lowercase, and unfolds each whitespace-prefixed continuation into its preceding value. Repeated names become ordered arrays, after which selected address, identity, route, and authentication fields are copied into a summary without validating their contents.

  • RFC 5322 folding is handled mechanically, but encoded words and each field’s internal grammar remain untouched.
  • A malformed colon-free field or an orphan continuation is rejected rather than silently attached to another value.

Worked example

Headers with Received hop trace
Parse SMTP headers including two Received hops to trace delivery path
Input
											From: Jane Doe <[email protected]>
To: [email protected]
Subject: Invoice #4021 attached
Date: Mon, 13 Jan 2025 14:22:00 +0000
Message-ID: <[email protected]>
Received: from smtp.example.com (10.0.0.1) by mx.example.com; Mon, 13 Jan 2025 14:22:01 +0000
Received: from client.example.com (192.168.1.5) by smtp.example.com; Mon, 13 Jan 2025 14:21:59 +0000
Output
												Received hops: 2

HEADERS
From: Jane Doe <[email protected]>
To: [email protected]
Subject: Invoice #4021 attached
Date: Mon, 13 Jan 2025 14:22:00 +0000
Message ID: <[email protected]>
Received: from smtp.example.com (10.0.0.1) by mx.example.com; Mon, 13 Jan 2025 14:22:01 +0000, from client.example.com (192.168.1.5) by smtp.example.com; Mon, 13 Jan 2025 14:21:59 +0000

SUMMARY
From: Jane Doe <[email protected]>
To: [email protected]
Subject: Invoice #4021 attached
Date: Mon, 13 Jan 2025 14:22:00 +0000
Message ID: <[email protected]>

When to use this

Delivery support follows Received fields across SMTP relays, deliverability investigations inspect SPF and DKIM reports, and incident responders extract Message-ID and address metadata while retaining raw evidence.

Edge cases

  • A DKIM-Signature split onto whitespace-prefixed lines is unfolded with one separating space and remains one field.
  • Received and received spellings refer to the same case-insensitive name, so both values survive in one ordered array and contribute two hops.
  • An Authentication-Results pass is exposed as header text only; RFC 8601 warns that presence outside a trusted mail boundary does not prove authenticity.

References