Email header analyzer
Paste a message's raw headers to see the route it took, how long each hop took, and how it fared on SPF, DKIM and DMARC.
What email headers are
Every email carries a block of headers above its body. Some are written by the sender: From, To, Subject, Date, Message-ID. Others are added along the way. Each server that relays the message adds a Received header at the top, with who it got the message from, its own name, the protocol and a timestamp. The receiving server adds Authentication-Results with its SPF, DKIM and DMARC verdicts (RFC 8601), and the sender's DKIM signature travels in DKIM-Signature.
Why it matters
When a message is late, lands in spam or fails authentication, the headers are the evidence. The Received chain shows where the time went: a few seconds per hop is normal; minutes usually mean a queue, greylisting or a retry. Authentication-Results show exactly which check failed and for which domain, which tells you whether to fix SPF, DKIM or alignment. Since February 2024, Gmail and Yahoo require bulk senders to pass SPF, DKIM and DMARC and to offer one-click unsubscribe on marketing mail, and the headers show whether a message does.
Common things to look for
- SPF pass but DMARC fail. SPF passed for the Return-Path domain (often your provider's), which doesn't match From. Set up DKIM with your own domain so DMARC can pass on DKIM.
- DKIM signed by the wrong domain. If
d=is your provider's domain, DKIM can't align with your From address. - A long delay at one hop. Greylisting, rate limits or a full queue at that server.
- Hops out of order. A server with the wrong clock, or a header added out of sequence.
- No List-Unsubscribe on marketing mail. Gmail and Yahoo expect one-click unsubscribe from bulk senders.
Only the topmost Authentication-Results, added by your own mail server, can be trusted; anything below it may have been written by an earlier server or by the sender. For the DNS side, use the SPF, DKIM and DMARC checkers.
Questions
How do I get the full headers?
Gmail: open the message, the three-dot menu, "Show original". Outlook on the web: the three-dot menu, "View", "View message source". Apple Mail: View, Message, All Headers (or Raw Source). Thunderbird: View, Message Source. Copy everything above the body.
Are my headers sent anywhere?
No. The analysis runs in JavaScript in this page; nothing you paste is uploaded, stored or logged. You can disconnect from the internet after the page loads and it still works.
Why are the hops listed in the opposite order to the headers?
Each server adds its Received header at the top, so the headers read newest first. We reverse them so the route reads from the sender to you.
Why is a delay negative?
Each server stamps its own clock. If one server's clock is wrong, a hop can appear to happen before the previous one. Small differences are normal; minutes or hours point to a misconfigured clock.
Which Authentication-Results should I trust?
The one added by your own receiving server, which is usually the topmost. Headers further down were added earlier and could have been written by anyone, including the sender.
What do Gmail and Yahoo require for unsubscribe?
Bulk senders' marketing and subscribed mail must support one-click unsubscribe (RFC 8058): a List-Unsubscribe header with an https URL, plus List-Unsubscribe-Post: List-Unsubscribe=One-Click, covered by the DKIM signature.
Your DNS is right. Now see how real people react to your email
simmail sends your app's mail to simulated people who open, ignore, junk, click and reply, so you can test what happens after delivery. Start free, no card.