Email headers

Analyze email headers: mail route, delays and auth results

Each server on the way adds a Received line, and the receiving server records the SPF, DKIM and DMARC results. Paste the full headers to see where the email waited and what failed.

The path of a message across servers as shown in Received headers

What the headers show

Every server that handled the email writes a Received line, so read them bottom up: the lowest line is the sender, the top one is your mailbox. Timestamps in neighbouring lines show where the email sat in a queue.

The receiving server adds Authentication-Results with the SPF, DKIM and DMARC outcome. If any of them fails, the email lands in spam more often.

When it helps

An email arrived late and you need the server where it got stuck.
Your newsletter goes to spam and you need the check that failed.
A suspicious email arrived and you want to know which server sent it.
You set up SPF, DKIM and DMARC and test them on a real email.

Questions and answers

01Where do I find the headers?

In Gmail, open the email, click More and Show original. In Outlook, go to File, Properties and copy Internet headers. In Apple Mail, choose View, Message, All Headers. Copy the whole block.

02Do the headers go to your server?

No. The analysis runs in your browser and the headers go nowhere. Internal mail is safe to paste.

03Why are the timestamps out of order?

Each server keeps its own clock. When a clock is off, the delay comes out negative. The analyzer marks those hops so you don't hunt for a delay that isn't there.

04How do I find the real sender IP?

Read the Received headers from the bottom up. The lowest one comes from the first server that took the letter, and it shows the address the letter left from. The upper lines come from the recipient servers.

05What does Authentication-Results mean?

The result of the checks written by the recipient server: spf=pass, dkim=pass, dmarc=pass. Where you see fail, fix that exact record in the sender's DNS.