Email Header Analyser
Paste the full headers to see each step the message took, how long each took, and what SPF, DKIM and DMARC results the receiving system recorded.
About Email Header Analyser
Behind every email is a block of headers that most mail programs hide. They record each mail system the message passed through, when it arrived at each, and the checks the receiving system made to decide whether the sender was genuine. When a message is late, lands in spam or looks suspicious, the headers hold the answer, but they are long, repeated and hard to read by eye.
This analyser lays them out. It lists the delivery steps from the oldest to the newest, works out the delay at each step and shows the total time in transit, and highlights the slowest step. It pulls out the SPF, DKIM and DMARC results that the receiving system wrote down, shows who signed the message and which headers the signature covers, and lists warning signs such as a Reply-To at a different domain, a return path that does not match, or a date that does not fit the route.
How to use Email Header Analyser
- In your mail program open the message and choose Show original, View source or Message details.
- Copy the headers from the first Received line down to the Subject, and paste them into the box.
- Read the summary figures, then the notes under What stands out.
- Look at the route table to see where the message waited.
Common uses
- Finding out why an email took hours to arrive
- Checking whether a suspicious message really came from the sender it claims
- Seeing why your own newsletters land in spam
- Confirming that your SPF and DKIM set-up works end to end
Frequently asked questions
Can I trust the results shown?
They are what the receiving mail system wrote down. Lines added by your own mail provider are the most reliable. Lines lower down were added by earlier systems and a sender can forge them, so be cautious about anything that is not at the top.
What do SPF, DKIM and DMARC mean?
SPF says whether the sending server is allowed to send for the domain. DKIM says whether the message carries a valid signature from the domain. DMARC says whether those checks line up with the address shown in From, and what the domain wants done if they do not.
Why is one step so slow?
A long gap usually means the message waited in a queue, was held for scanning, or was retried after a temporary error. Clocks on mail systems are also not always in step, so a small negative delay can be a clock difference rather than a real fault.
Why does it say there are no results?
The checks are added by the receiving system. If the headers were copied from a program that strips them, or if the message never went through a system that adds them, no results appear.
Does the tool check the sender records itself?
No. It reads the text you paste and reports what is in it. To check the records of a domain, use an SPF, DKIM and DMARC checker.