Email Header Analyzer
Free email header analyzer — paste raw headers to decode SPF, DKIM, and DMARC results, trace the delivery path, and check sender alignment in your browser.
What Are Email Headers?
Every email carries a set of metadata fields called headers. These are normally hidden from the recipient but contain critical information: who sent the message, which servers handled it, and whether it passed authentication checks like SPF, DKIM, and DMARC. Headers are defined primarily in RFC 5322 (Internet Message Format).
How to Find Raw Headers
Each email client exposes raw headers differently:
| Client | Steps |
|---|---|
| Gmail | Open the message, click the three-dot menu (⋮), select "Show original". |
| Outlook (web) | Open the message, click "…" → "View" → "View message source". |
| Apple Mail | Open the message, go to View → Message → All Headers (or ⌥⌘U for raw source). |
| Thunderbird | Open the message, go to View → Message Source (Ctrl+U). |
What Authentication-Results Tells You
The Authentication-Results header (defined in
RFC 8601) is added by the receiving mail server and summarizes the authentication
checks it performed. It reports verdicts for SPF, DKIM,
DMARC, and optionally
ARC. A pass verdict means the check
succeeded; a fail means the message did not authenticate
properly for that protocol.
Microsoft adds a value of its own: dmarc=bestguesspass means
the sender's domain publishes no DMARC record, not that DMARC passed. The
analyzer flags it under the results.
Why that mattered during the November 2026 Outlook.com bounces.
Understanding the Received Chain
Each server that handles the message adds a Received: header.
Reading these from bottom to top traces the message's path from origin to
destination. Long delays between hops can indicate routing issues,
greylisting, or content scanning. Clock skew between servers occasionally
produces negative delays, which are harmless but worth noting.
For a worked example that walks a real Received: chain and
decodes the ARC set line by line, read
how to read email headers.
Frequently asked questions
How do I analyze email headers?
Paste the full raw headers from a message (in Gmail, "Show original"; in Outlook, "View message source"). The analyzer reads the Authentication-Results header to show the SPF, DKIM, and DMARC verdicts, traces every Received hop with its delay, and compares the From domain with the Return-Path and Reply-To domains.
Where do I find an email's headers?
In Gmail, open the message, click the three-dot menu, and choose "Show original." In Outlook, open the message and select File → Properties, or "View message source." Copy the full text — including every Received: line — and paste it in.
Is the email content stored?
No. The analyzer parses headers in your browser; nothing is uploaded to or stored on our servers. The only network requests are DNS lookups for the From, Return-Path, and Reply-To domains, sent to Cloudflare's DNS-over-HTTPS resolver to find their organizational domains; the header text itself never leaves the page.
How do email headers reveal a spoofed email?
Check the Authentication-Results header: spf=fail, dkim=fail, or dmarc=fail are red flags. Compare the From address against the Return-Path and the DKIM signing d= domain — mismatches signal forgery. Unexpected or foreign Received: hops in the delivery chain also expose a spoofed or phishing message.
Get the full picture with DMARCguard
Continuous monitoring, aggregate report parsing, and actionable insights for all your email authentication protocols.
Start Free