Email header analyzer
Paste the headers of an email you received. The email header analyzer shows whether it passed SPF, DKIM and DMARC, and which servers it went through. No account needed, and we don't store the headers.
What an email header analyzer shows you
Every server that handles a message adds a Received line to the top of it. The server that
delivers it to the inbox also adds an Authentication-Results header with its SPF,
DKIM and DMARC results. This email header analyzer reads those lines and shows each result,
the domain each check was for, and whether that domain matches the From address.
Start with DMARC. It passes when SPF or DKIM passes for a domain that matches the From address. A message can pass SPF and still fail DMARC, because SPF checked the sending platform's bounce domain instead of yours. The Matches From column shows when that happened.
These results are what the receiving server saw when the message arrived. We don't look anything up in DNS. To check what a domain publishes today, follow the links in the table to our DMARC, SPF and DKIM checkers.
Questions
How do I find the headers of an email?
In Gmail, open the message, choose More (the three dots) and then Show original. In Outlook on the web, open the message, choose More actions, then View and View message details. In Outlook for Windows, open the message and choose File, then Properties, and copy the Internet headers box. In Apple Mail, choose View, then Message, then All Headers. Copy from the top down to the first blank line.
Why does SPF pass but DMARC fail?
SPF checked a domain that doesn't match the From address. Sending platforms often use their own bounce domain, so SPF passes for them and not for you. DMARC then needs a DKIM signature from your domain. The alignment guide shows how to set one up on each platform.
Why is there no Authentication-Results header?
The receiving server adds it when the message arrives. A copy from your Sent folder never arrived anywhere, so it has none. Send a test message to a Gmail or Outlook address and paste the headers from the copy that arrived there.
What does a long delay between two servers mean?
One server held the message before passing it on. Spam filtering, a full queue or greylisting can each add minutes. A negative delay means the two servers' clocks disagree, so read it as zero.
Why did DKIM fail on a message I sent?
Either the message changed after it was signed, or the public key in DNS doesn't match the key that signed it. A footer added by a mailing list or a security gateway is the usual change. The DKIM fail guide covers both causes.
What happens to the headers I paste?
We read them in memory to build this page and drop them when the page is sent. They aren't stored, logged or attached to an account. Server IP addresses appear only on the result you get back, never in a link to it. The sign-up card on a result has the From domain filled in, and it reaches us only if you submit that form.
See every sender that uses your domain
Receivers report every sender that uses your domain. We read those reports, mail you a summary each Monday and, on a paid plan, email you when a new sender fails.
Get the weekly digestFree for your first domain · No card · Per-source totals kept for life