Email header analyser
Paste the headers from an email to see the route it took, what the receiving servers recorded for SPF, DKIM and DMARC, and whether its domains line up.
Paste the headers
Read in your browser. Headers contain names and addresses, so nothing you paste is sent to us.
Finding headers, and what they can and can't tell you
Getting the headers
- Gmail: open the email, the three-dot menu, then Show original. Copy everything above the message body.
- Outlook on the web: the three-dot menu, then View and View message details.
- Outlook desktop: File, Properties, then the Internet headers box.
- Apple Mail: View, Message, All Headers.
Reading the result
Each server that handles an email adds a Received header at the top, so the route reads from the bottom up. Big delays between two hops point at the server that held on to the message. Authentication-Results is the receiving server's record of SPF, DKIM and DMARC; the one at the top was written last, by the mailbox provider.
DMARC passes when SPF or DKIM passes for a domain that lines up with the From address. A newsletter tool that signs with its own domain (a DKIM d= that isn't yours) can pass DKIM and still fail DMARC.
What it can't tell you
Headers are text. Anyone who handled the email before the receiving server could add an Authentication-Results line that says "pass", which is why this tool reports what was recorded rather than giving a verdict. To check a sender properly, send one email to the free email test: it works out SPF, DKIM, DMARC, TLS and reverse DNS itself from the connection, and ignores the claims in the headers.
Do this for every client, every day
- All nine checks on every client domain, daily, graded A to F
- Alerts by email or webhook when a grade drops or a record changes
- A monthly report card for each client, with your logo on it
- Hosted DMARC, SPF, DKIM and MTA-STS, so fixes don't wait for a DNS login
Start a free 28-day trial: up to 3 domains, no card needed.
Keep going
- What is DMARC? A plain-English guideThe guide
- No SPF recordHow to fix it
- DKIM not foundHow to fix it
- No DMARC recordHow to fix it
- DMARC p=none or pct below 100How to fix it
- DKIM checkerFind a domain's DKIM keys, with or without the selector, and check their size.
- DMARC report analyserUpload a DMARC aggregate report and see who sent email as the domain, and what passed.
- Sender requirements checkerCheck a domain against Google, Yahoo and Microsoft's rules for bulk senders.
- Free domain checkerAll nine checks on a domain, with a grade from A to F.
- Report cardsWhat your clients get each month, with your logo on it.
Questions
Do you see the headers I paste?
No. They're read by your browser and never sent to us. Headers contain names and email addresses, so we'd rather not have them.
Can I trust an Authentication-Results pass?
Only the one your own mailbox provider added at the top. Earlier ones can be written by anyone along the way. The email test works out the results itself.
Why does DKIM pass but DMARC fail?
The signature is for a domain that doesn't match the From domain, usually the sending service's own. Set up DKIM with your domain at that service.
What does 'aligned (relaxed)' mean?
The domains share the same organisational domain (news.example.co.uk and example.co.uk). That's enough for DMARC unless the record sets adkim=s or aspf=s.
Why is a hop's delay negative?
The two servers' clocks disagree. It says nothing about the email itself.
Check every client's email set-up, every day.
Start a free 28-day trial: up to 3 domains, no card needed.