Email Header Analyzer
Read authentication results, key message fields and the delivery path from raw email headers.
Your headers stay local: analysis runs in your browser and is not sent to our server. Headers may contain email addresses and internal server details; share results carefully.
How to interpret the result
SPF checks whether the sending server is authorized for the envelope domain. DKIM verifies a cryptographic signature. DMARC requires alignment between the visible From domain and an authenticated SPF or DKIM domain.
Why Received headers appear in reverse order
Each mail server adds a Received line above existing headers. Reading them from the bottom upward usually reconstructs the message route from the original sender toward your mailbox.
Use results as diagnostic evidence
A pass does not prove a message is trustworthy, and a failure may result from forwarding or configuration mistakes. Combine header evidence with the sender, content, links and your mail provider’s security signals.
When to use the Email Header Analyzer
Use it when a message went to spam, was rejected or looks spoofed: the headers show which servers handled it and whether SPF, DKIM and DMARC passed.
Examples
- Paste the headers of a message that landed in Gmail spam and check the Authentication-Results line.
- Trace the Received hops to find where a delay was added.
Common mistakes
- Pasting only the visible From and Subject instead of the full original headers.
- Reading Received headers top-down; the oldest hop is at the bottom.
Created by Muhammad Irfan Aslam, Senior Systems & Cloud Engineer.
Case study: How I fixed a server whose mail was going to spam →Tutorial on LearnWithIrfan: Mail servers on Ubuntu →