Email header analyzer

Headers are the record of how a message travelled and whether it passed the receiver's checks. They are the first thing to read when mail is late, in spam or suspicious.

How to get the headers

| Mail client | Where | |---|---| | Gmail | Open the message, three-dot menu, Show original, then Copy to clipboard | | Outlook (web) | Open the message, three-dot menu, View, View message source | | Outlook (desktop) | File, Properties, the "Internet headers" box | | Apple Mail | View, Message, All Headers |

What the report shows

• Authentication results. The receiving server's verdict on SPF, DKIM and DMARC. Look for pass on all three.
• Alignment. Whether the domain that passed matches the visible From domain. A pass on a different domain does not satisfy DMARC.
• Delivery path. The Received lines in order, oldest first, with the time between hops. A large gap marks where a message waited.
• Mismatches. A Reply-To on another domain, a Return-Path on a third-party domain, or a missing Message-ID or Date.

Reading common results

| You see | Meaning | |---|---| | spf=pass, dkim=pass, dmarc=pass | Authentication is fine. Look at reputation and content next | | dmarc=fail with spf=pass | SPF passed for another domain than the From address. Fix alignment | | dkim=none | The message was not signed. Enable DKIM at your sender | | spf=softfail | The sending server is not in your SPF record | | A 10-minute gap at one hop | That server queued or greylisted the message |

Next steps

Check the sending domain's records with the email DNS checker, then follow the spam debugging guide. To understand each result in depth, read SPF, DKIM and DMARC explained.