Email header analyzer

Where to find the raw headers

Gmail: open the message, click the three dots, then Show original.

Outlook and Outlook.com: open the message, File, Properties, and copy the Internet headers box. On the web, the three dots, then View, then View message details.

Apple Mail: View, Message, then All Headers.

Copy everything from the first Received: line down to the blank line before the body. Partial headers still work, but the delivery path and the authentication results are the parts worth having.

What the results mean

SPF pass means the server that sent the message was on the list published by the return-path domain. It breaks whenever mail is forwarded, because the forwarder sends from its own IP, and that alone is survivable.

DKIM pass means the signature verified: the message was not altered in transit, and crucially the signature travels with the message, so it survives forwarding. This is the check that matters most.

DMARC pass is the one that protects the address a human actually reads. It requires SPF or DKIM to pass and to be aligned with the visible From domain. That word alignment is where most confusion lives, which is why this tool computes it separately rather than trusting the receiving server's summary: a DKIM signature can verify perfectly and still fail DMARC because it signs a different domain than the one in the From header.

The delivery path

Each Received: header is one hop, written newest first, so the bottom of the list is where the message started. The per-hop delays are worth reading when a message arrived late: a long gap on one hop usually means greylisting or a queue at the receiving end, not a problem on your side.

If you want to check the domain rather than one message, the email setup checker reads live DNS for SPF, DKIM, DMARC and MX, and the DMARC record generator writes a valid policy record for you.