Less boo. More booked. Halloween offer: 30 days free on any paid plan. Claim 30 days freeEvery new account gets one free mailbox for warmup and replies. No domain to buy. See how it works

Free tool, no signup

Email header analyzer

Paste an email's headers and this tool reads them for you: whether SPF, DKIM and DMARC passed, which servers the message went through, and where it waited. It runs in your browser, so the headers are not uploaded or stored.

How to get the headers

Open the copy of the message that arrived, not the one in your Sent folder, because the receiving server is the one that writes the authentication results. Menus change between versions, but these are the usual routes.

Gmail: open the message, choose the three dots, then Show original, then Copy to clipboard.
Outlook on the web: open the message, choose the three dots, then View, then View message details.
Outlook for Windows: double-click the message, then File, Properties, and copy the Internet headers box.
Apple Mail: choose View, then Message, then All Headers, and copy what appears.

Copy everything from the first line down to the blank line before the message. If you copy the whole message by mistake, the tool ignores the body.

Reading the result

SPF says whether the server that sent the message was allowed to send for the domain in the envelope sender. DKIM says whether a signature added by the sending domain still matched the message when it arrived. DMARC passes when SPF or DKIM passed and the domain it vouched for matches the domain in From. That last part is why SPF and DKIM can both pass and DMARC still fail.

A pass on all three does not promise the inbox. Placement also depends on the sender's reputation and on how recipients treat the mail. To check the records behind a failure, use the deliverability checker, or the SPF, DKIM and DMARC checkers.

What the route tells you

Every server that handles a message adds a Received line at the top, so the list reads newest first. The tool turns it round so step 1 is where the message started and the last step is the server that delivered it. The wait is the time between one step and the next.

A few seconds per step is normal. A long wait at one step usually means the message sat in a queue, or the receiving server asked the sender to try again later (greylisting). Servers' clocks are not perfectly in step, so differences of a second or two, or a negative number, are noise.

What headers cannot tell you

Anyone can write any header. Only the lines added by the server that delivered the message to your mailbox are reliable, and that is the top Authentication-Results line. A Received line further down could have been written by the sender.

This tool also does not look anything up and does not re-check a signature. It reports what the receiving server wrote. If you suspect a message is a forgery, treat the headers as one clue and report it through your mail provider rather than relying on this page.

To keep your own sending healthy, see SPF, DKIM and DMARC for cold email and why emails go to junk.

Questions

Is it safe to paste a real email's headers?

The analysis runs in your browser. The text you paste is not sent to a server or stored. Headers can still contain addresses, server names and IP addresses, so remove anything you would not want to share before you paste them anywhere else.

Where do I find an email's headers?

In your mail program's message source or original view. In Gmail it is the three dots, then Show original. Open the copy that arrived, not the copy in your Sent folder.

Why does it say there are no authentication results?

The receiving server adds the Authentication-Results header when it delivers a message. A copy in your own Sent folder was never received by anyone, so it has none. Some providers also leave it out for mail between their own users.

SPF and DKIM passed, so why did DMARC fail?

DMARC needs a pass that matches the domain in the From address. An SPF pass for a sending service's own bounce domain, or a DKIM signature from the service's domain, does not match your From domain. Set up DKIM signing as your own domain at the sending service.

Which Received line is the original sender?

The bottom one. Each server adds its line at the top, so the list reads newest first. The tool reverses it for you so step 1 is the first server that handled the message.

Can I trust everything in the headers?

No. Anyone can write any header. The Authentication-Results line added by your own provider's server is reliable. Lines further down were written by earlier servers or by the sender and can be made up.

Does it give a spam score?

No. It shows the spam headers the receiving server itself added, if any, such as an X-Spam-Status line. Those are that server's own scores, and other providers score the same message differently.

Catch a broken record before your recipients do.

Warmerly checks SPF, DKIM, DMARC and blocklists on every sending domain every day, and warms your mailboxes while it does.

Start free See pricing

Free plan: 1 mailbox and 1 active campaign, no card needed. Paid plans start with a 7-day trial.