Free tool
Email header analyzer
The trail is written backwards. Paste a raw header block and get the route the message took, where the time went, and what the receiving server decided about SPF, DKIM and DMARC.
Route. Every hop in delivery order, first machine first.
Time. The gap at each hand-off, and which one swallowed the delay.
Verdict. What SPF, DKIM and DMARC actually returned, plus any ARC chain.
Paste your own block, or load the example to see what the output looks like.
The reading
What the block says
Received lines are unfolded, reversed into delivery order and timed against each other. Authentication results are read verbatim, including the reason text, because that is usually the only clue about why something failed.
Waiting for a header block
Paste one into the box above, or press Load an example, and the reading appears here.
Reading order
The last line written is the first thing that happened
Each server adds its Received line to the top of the message, so the block arrives in reverse. This tool flips it, which is why hop 1 here is the first machine that handled the message rather than the last.
As written
Top of the block first. Newest stamp on top.
each server prepends its own line
As it happened
Delivery order. Hop 1 is the first machine.
the gap between stamps is the delay
The forward
A failing SPF is not always a forgery
A mailing list or forwarder relays the message from its own address, which breaks SPF for the original sender. If the message carries an ARC chain, the results recorded before the relay are shown separately, which is how you tell a forward apart from a forgery.
ARC-Authentication-Results · i=1 · chain none
Authentication-Results · inbound.example.net
Example block · DMARC still passes because DKIM survived the relay
Asked often
Questions
In Gmail, open the message, then the three-dot menu, then "Show original". In Outlook, open the message and choose File, then Properties, and copy the internet headers. In Apple Mail, use View, then Message, then Raw Source.
No. This email header analyzer parses everything in your browser. There is no server route behind the page, so the header block never leaves your machine, and nothing is logged or stored.
Each server adds its Received line to the top of the message, so the last line written is the first hop that happened. This tool reverses them, so hop 1 is the first machine that handled the message.
A mailing list or forwarder relays the message from its own address, which breaks SPF for the original sender. If the message carries an ARC chain, the results recorded before the relay are shown separately, which is how you tell a forward apart from a forgery.
No. It means two servers disagree about the time. The tool flags it rather than hiding it, because a clock difference makes every other timing on the page approximate.