Email Header Analyzer
Paste email headers to check SPF, DKIM and DMARC, trace every hop and spot spoofing.
What Is an Email Header Analyzer?
Every email carries a block of headers including who sent it, every server it passed through, and what each receiving server concluded about it. They're hard to read raw and this is where our email header analyzer turns them into troubleshooting answers like
- did the message pass SPF
- DKIM and DMARC
- where did it come from
- how long did each hop take
- did a spam filter flag it
How to Use It
- Copy the full headers of the email from your mailbox, or open a saved
.emlfile. - Paste them and click Analyze headers.
- Read the results:
- Verdict: whether the message is authenticated as coming from its From domain.
- Authentication: the SPF, DKIM and DMARC results, whether each one matches the From domain, and the records the sender publishes in DNS today.
- Findings: spoofing signs, delays and setup problems, in plain English.
- Delivery path: every server hop, oldest first, with how long the message spent at each.
- Spam filter verdicts: Microsoft (SCL, BCL, SFV, CAT) and SpamAssassin scores, decoded.
How to Find Email Headers
| Email app | Where the headers are |
|---|---|
| Gmail | Open the email, click ⋮ More next to Reply, then Show original. Click Copy to clipboard. |
| Outlook on the web and new Outlook | Open the email, click … More actions, then View → View message source. |
| Classic Outlook for Windows | Open the email in its own window, then File → Properties. The headers are in Internet headers. |
| Apple Mail | Open the email, then View → Message → All Headers, or Raw Source (⌥⌘U) for everything. |
| Yahoo Mail | Open the email, click … More, then View raw message. |
Copy the headers from the recipient's mailbox as the authentication results are added by the receiving server.
SPF, DKIM and DMARC Results Explained
| Result | Meaning |
|---|---|
| pass | The check succeeded. |
| fail | The check failed: the server isn't allowed to send for the domain, or the signature doesn't verify. |
| softfail | SPF only: the server probably isn't allowed, but the domain asks receivers not to reject outright (~all). |
| neutral | The domain makes no statement about this server (?all). |
| none | Nothing to check: no SPF record, no DKIM signature, or no DMARC policy. |
| temperror | A temporary DNS problem stopped the check. It may pass on a retry. |
| permerror | The record is broken, for example SPF needing more than 10 DNS lookups. |
For DMARC to pass, SPF or DKIM has to pass for a domain that aligns with the From address: the same domain, or a subdomain of it. That's why a message can pass SPF and still fail DMARC.
Reading the Delivery Path
Each server that handles a message adds a Received header on top, so the oldest hop is at the bottom of the raw headers. The analyzer reverses them into delivery order and measures the time between each one. A few seconds end to end is normal. Minutes at a single hop usually mean retries, greylisting, or a queue for filtering. A hop marked TLS was encrypted in transit.
Frequently Asked Questions
No. The headers are parsed and analyzed in your browser. To show what the sender publishes, the tool looks up only the sender's domain, DKIM selectors and sending IP; the headers themselves, and the addresses in them, never leave the page.
SPF checks that the server that sent the message is allowed to send for the envelope domain. DKIM checks a cryptographic signature added by the sending domain. DMARC passes when SPF or DKIM passes and that domain matches the From address, which is what stops someone else from sending as your domain.
DMARC needs alignment: the domain SPF checked (the envelope or Return-Path domain) must match the From domain. Email services often send from their own bounce domain, so SPF passes for them, not for you. Sign your mail with DKIM using your own domain, or set up a custom return path with your email provider.
Look for a failed DMARC result, SPF or DKIM failing for the From domain, a Reply-To that points somewhere else, or a display name that shows a different address than the real sender. The analyzer flags each of these under Findings.
The Delivery path shows how long the message spent between each server. Long gaps usually mean a server was busy and retried later, the receiver was greylisting a new sender, or the message waited in a queue for spam or malware scanning.
SCL (spam confidence level) is Microsoft's spam score: -1 skips filtering, 0 and 1 are clean, 5 and 6 go to Junk, 9 is high-confidence spam. BCL (bulk complaint level) rates bulk senders from 0 to 9 by how many complaints they get. The analyzer decodes both, along with the SFV verdict and CAT category.
Need this at scale? Try the DNS Record API.
Look up any domain's SPF, DKIM and DMARC records as JSON, the same lookups this analyzer runs on the sender.
curl -X POST https://api.geekflare.com/dnsrecord \
-H "x-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"_dmarc.example.com","types":["TXT"]}'