Email Header Analyzer
Paste raw email headers to get a full breakdown of routing, delivery hops, authentication results and timing.
About Email Header Analysis
Every email message carries a set of headers that document its path from sender to recipient. These headers are generated by each mail server the message passes through and contain authentication results, delivery timestamps, and routing information. Analysing headers is the primary technique for investigating email deliverability problems, phishing attempts, and spoofed senders.
How to find email headers
- Gmail — Open the email, click the three-dot menu, select "Show original"
- Outlook — Open the email, go to File → Properties — the headers are in the "Internet headers" box
- Apple Mail — View → Message → All Headers
- Office 365 / Outlook Web — Open email, click "…" → View → View message source
Key headers to look for
- Authentication-Results — Shows SPF, DKIM, and DMARC pass/fail results as recorded by the receiving server. This is the most important header for diagnosing authentication failures.
- Received — Added by each server the email passes through. Reading from bottom to top, these trace the delivery path. Timestamps show how long the message spent at each hop.
- Return-Path — The envelope sender address used for bounce messages. SPF checks validate the Return-Path domain, not the From address.
- DKIM-Signature — The cryptographic signature added by the sending server. Contains the selector (
s=) and signing domain (d=). - X-Spam-Status / X-Spam-Score — Anti-spam scores added by spam filters. Positive score means more spammy.
Frequently asked questions
Where do I find email headers?
In Gmail: open the email, click the three-dot menu, then 'Show original'. In Outlook: open the email, go to File > Properties > Internet headers. In Apple Mail: View > Message > All Headers.
What does DKIM=pass mean?
DKIM=pass means the email's DKIM signature was verified successfully — the email content has not been tampered with since it was signed.
What does SPF=fail mean?
SPF=fail means the sending IP is not listed in the domain's SPF record — the email may be spoofed or sent from an unauthorised server.