- From
- To
- Reply-To
- Different domain
- Date
- Return-Path
- Message-ID
- Delivery
Likely originating server
Best guessNo public IP address found in the Received headers.
Authentication & DMARC alignment
| Check | Result | Domain | Aligned with From |
|---|---|---|---|
| SPF | |||
| DKIM | No DKIM-Signature header | — | |
| DMARC |
Added by the receiving server
| Method | Result | Properties |
|---|---|---|
Received-SPF
DKIM-Signature headers
| Domain (d=) | Selector (s=) | Algorithm (a=) | Signed headers (h=) |
|---|---|---|---|
| Check key | l= set |
Delivery path
No Received headers.
| Hop | From | By | With | Time (UTC) | Delay |
|---|---|---|---|---|---|
| TLS | — |
ARC chain
| i= | Sealed by (d=) | Chain (cv=) | Results recorded by that hop |
|---|---|---|---|
ARC (RFC 8617) lets forwarders and mailing lists record the authentication results they saw, so a later receiver can trust mail whose SPF or DKIM broke in forwarding. cv=none is normal on the first set; later sets should be pass.
Unsubscribe
- List-Unsubscribe
- List-Unsubscribe-Post
Spam filter headers
Each filter uses its own scale and rules, and these headers reflect what the receiving system decided, not why. Treat them as hints.
All headers
Unfolded, encoded words decoded
About the Email Header Analyzer
Every email carries a block of headers that records how it travelled and how the receiving server judged it. This tool reads that block in your browser and turns it into something you can act on: the delivery path, the authentication results, and whether the message passes DMARC.
It unfolds long headers (RFC 5322), decodes encoded subjects and names (RFC 2047), and parses each Received header into from, by, with, id, for and the timestamp. The hops are shown oldest first with the delay between them, so slow relays and greylisting stand out, and negative delays reveal servers whose clocks disagree. It also reads Authentication-Results, Received-SPF, every DKIM-Signature, ARC sets, List-Unsubscribe with one-click support (RFC 8058), and common spam filter headers.
For DMARC it compares the From domain with the SPF domain (the envelope sender) and each DKIM d= domain, under relaxed and strict alignment. Relaxed alignment uses a short list of public suffixes rather than the full list, so check unusual country domains by hand.
How to use it
- Open the message source: Show original in Gmail, View message source in Outlook, or save it as an
.emlfile. - Paste the headers or the whole message, or open the
.emlfile. Parsing stops at the first blank line, so the body is ignored. - Read the summary, then the delivery path and authentication tables.
Nothing is uploaded. The likely originating IP is a best guess: the first hop, from the top, where a server outside the receiving organization handed the message over. Headers below that point were written by the sender and can be forged.
Examples
- Select Load a sample to see a newsletter that passes DMARC through aligned DKIM, uses one-click unsubscribe and has a Reply-To on another domain.
Common questions
Why does SPF pass but DMARC fail?
SPF checks the envelope sender, often a bounce domain of your email provider. DMARC only counts SPF when that domain matches the From domain. Sign with DKIM using your own domain to fix it.
Which Authentication-Results header should I trust?
The one added by your own receiving server, normally the topmost. Others come from earlier hops or the sender.
Related tools
- SPF, DKIM & DMARC Checker: check the sender domain's DNS records.
- Blacklist Checker: look up the originating IP on spam blocklists.
- IP Lookup: find who owns a sending IP address.