Email Header Analyzer
Paste raw message headers. See the delivery path, per-hop delays, and the SPF / DKIM / DMARC verdicts the receiving server recorded. Headers never leave your browser.
Parsed locally: your headers never leave your browser.
How to get raw headers. In Gmail, open the message, click the ⋮ menu, and choose Show original, then copy everything from the page that opens. In Outlook on the web, open the message, click ⋯ → View → View message details. In Apple Mail, select the message and choose View → Message → All Headers (or Raw Source). Paste the whole block above; any body text after the headers is ignored automatically.
The verdict chips show what the receiving server recorded in its Authentication-Results header: a pass there is the ground truth for that delivery, not a prediction. The delivery path lists every relay hop in chronological order with the time each hop added; large delays usually point at greylisting or a queue backlog. Findings flag the common problems: a message that passes neither SPF nor DKIM, a signing domain that does not match the visible From, or a missing Message-ID.
Email header analyzer FAQ
Are my headers uploaded to your server?
No. The analyzer runs entirely in your browser and nothing is transmitted, logged, or stored. Headers contain IP addresses and email addresses, so they stay on your machine. You can check in your browser devtools that the Analyze button makes no network request.
How do I get the raw headers of an email?
In Gmail: open the message → ⋮ menu → Show original. In Outlook on the web: ⋯ → View → View message details. In Apple Mail: View → Message → All Headers. Copy the whole block and paste it here.
What does "Neither SPF nor DKIM passed" mean?
The receiving server could not authenticate the message with either method. Gmail and Outlook reject or junk such mail (Gmail answers with 550 5.7.26). Check your SPF record with our SPF checker and your DKIM key with the DKIM checker.
Why do some hops show an internal IP?
Relays inside the sender's own infrastructure use private addresses (10.x.x.x, 192.168.x.x and similar) that are not routable on the public internet. They are labeled internal and are normal. The hop that matters for reputation is the first public IP that handed the message to the receiver.