Analyze email headers
Paste the raw headers of a message to see the route it took, the delay at each hop, and whether SPF, DKIM and DMARC passed. No account.
Want authentication handled for you?
You add a few DNS records once. We keep SPF, DKIM and DMARC current for your sending domain, sign mail with your own domain, and add one-click unsubscribe to marketing mail.
What the headers of a message tell you
Every server that handles a message adds a Received line at the top, so the headers read from newest to oldest. Reversed, they show the route: which server sent it, which ones passed it on, and how long each step took.
Authentication results
The receiving mailbox records whether SPF, DKIM and DMARC passed in an Authentication-Results header. DMARC passes only when SPF or DKIM passes for a domain that matches the From address, which is why the analyzer shows alignment next to each result.
What the analyzer flags
DMARC failures, DKIM signed by a domain other than yours, an unaligned Return-Path, bulk mail without one-click unsubscribe, a free mailbox address on bulk mail, and any hop that took longer than an hour.
Email header questions
How do I get the raw headers?
In Gmail, open the message and choose Show original from the three-dot menu. In Outlook, look for View message source or Message details; in the desktop app it is under File, Properties. In Apple Mail, use View, Message, All Headers. Menu names change between versions, so look for original, source or headers.
Do you keep what I paste?
No. Headers hold real addresses and IP addresses, so they are read in memory to build the report and then discarded. Nothing is logged or saved, and the email-me option below a result does not include them.
Why are there several Authentication-Results headers?
Each server that checks the message can add one. Only the top one was written by the mailbox that received the message. Lower ones were added earlier on the way, or by the sender, and anyone can write one, so they prove nothing.
Why is a hop's delay unknown?
Some servers do not write a time, and server clocks are not always in step. A time that goes backwards is shown as unknown rather than as a negative delay.