Email header analyzer

Paste the headers of any email to see each hop and its delay, the SPF, DKIM, DMARC and ARC results, and the spam scores.

ExampleSample headers
A Google Workspace cold email into a Google Workspace inbox. Paste your own to analyze them.
Runs in your browser. The headers never leave your device.
Runs in your browser. The headers never leave your device.Showing the sample21 headers read
3of 3
SPF, DKIM and DMARC passed for the From domain

Authenticated, with warnings

SPF passDKIM passDMARC pass

This email authenticated as northwind-outbound.com and Google Workspace did not flag it. SPF and DKIM passed for the From domain, so DMARC passed (policy p=none). It arrived 43 s after it was sent, over 3 hops. 1 thing to tidy up below.

7 checks5 pass2 not reported
Delivery time
43 s
3 hops
Received by
Google Workspace
mx.google.com
Sent through
Google Workspace or Gmail
From northwind-outbound.com
Spam filters
No verdicts
None written

Needs attention

1 finding, worst first.
DMARC passes but does not enforce
northwind-outbound.com publishes p=none, so a receiver does nothing when someone spoofs it. Move to quarantine, then reject, once your reports show only your own senders.
p=none
4 passed, 1 for information
Nothing to do here. Open it to see the evidence for each one.
SPF passed and alignedDKIM passed and alignedTLS on the way inDelivered in 43 sNo List-Unsubscribe header
ShowHide
SPF passed and aligned
The sending IP is allowed by the SPF record of northwind-outbound.com.
smtp.mailfrom=northwind-outbound.com
DKIM passed and aligned
Signed by northwind-outbound.com with selector google.
header.d=northwind-outbound.com
TLS on the way in
Every hop between servers was encrypted.
Delivered in 43 s
3 hops from the Date header to the mailbox, none of them slow.
No List-Unsubscribe header
Fine for one-to-one email. Senders of more than 5,000 a day to Gmail or Yahoo need one-click unsubscribe (RFC 8058).

Route

Read bottom up in the raw headers. Hop 1 is the sender's first server, the last hop is the mailbox.
12002:a05:7208:3184:b0:9f:5b0e:1a2b
HTTP+1 s
14:41:32 UTC
2mail-sor-f41.google.com [209.85.220.41] to mx.google.com
SMTPSTLS+41 s
14:42:13 UTC
32002:a05:6022:2a8:b0:6d4:1e7f:3b2c
SMTP+1 s
14:42:14 UTC
43 s from the Date header to the mailbox, over 3 hops.

Authentication results

As written by mx.google.com, the top Authentication-Results header. Headers further down can be added by anyone on the way.
Check
Result
Domain
Aligned
Detail
SPF
pass
northwind-outbound.com
Yes
google.com: domain of [email protected] designates 209.85.220.41 as permitted sender
DKIM
pass
northwind-outbound.com
Yes
selector google
DMARC
pass
northwind-outbound.com
-
policy p=none
DKIM signature
d=northwind-outbound.com s=google a=rsa-sha256 (13 headers signed)
ARC chain
i=1 google.com cv=none

Spam and filter headers

No filter wrote a verdict into this copy. Gmail and Yahoo usually don't, so check the folder it landed in.

Message

The identity headers. They stay on this page and never go in the emailed report.
From domain
northwind-outbound.com
Return-Path domain
northwind-outbound.com
Subject
Northwind's carrier onboarding
Date
Fri, 16 Oct 2026 16:41:31 +0200
Message-ID domain
mail.gmail.com
Unsubscribe
No List-Unsubscribe header
All 21 headers
In the order they appear, top to bottom.
ShowHide
Delivered-To: [email protected]
Received: by 2002:a05:6022:2a8:b0:6d4:1e7f:3b2c with SMTP id g8csp912345lxa; Fri, 16 Oct 2026 07:42:14 -0700 (PDT)
X-Received: by 2002:a17:906:3b92:b0:a9a:1c2e:4d10 with SMTP id u18mr2145678ejf.133.1792161734126; Fri, 16 Oct 2026 07:42:14 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1792161734; cv=none; d=google.com; s=arc-20240605; b=Tq1mFz8Yx0k3Lr6Q2hVb9sWc4Nd7Pe1Ga5Jf8Ku2Mo3Iy6Xt0Rz4Ev7Bw1Cq9Hs
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=9fQe2xV0Lk3sR7bN1mT4yP8wD6cJ5hG2aZ0uK9oE3iA=; b=Lp4Kx7Qw2Ns9Rd1Vm6Ft3Hb8Jc5Gz0Ya4Ue7Io2Pk9Mr6Tl1Xs3Bn8Cv5Dq0Ew7Fh
ARC-Authentication-Results: i=1; mx.google.com; dkim=pass [email protected] header.s=google header.b=Kq3vZx1a; spf=pass (google.com: domain of [email protected] designates 209.85.220.41 as permitted sender) [email protected]; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=northwind-outbound.com
Return-Path: <[email protected]>
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id a640c23a62f3a-a9a0f2c1b5esor1834567966b.4.2026.10.16.07.42.13 for <[email protected]> (Google Transport Security); Fri, 16 Oct 2026 07:42:13 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
Authentication-Results: mx.google.com; dkim=pass [email protected] header.s=google header.b=Kq3vZx1a; spf=pass (google.com: domain of [email protected] designates 209.85.220.41 as permitted sender) [email protected]; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=northwind-outbound.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=northwind-outbound.com; s=google; t=1792161733; x=1792766533; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject:date:message-id:reply-to; bh=2nM7cQ0vK4xR9sT1bL6wP3yD8hF5jG0aZ2uE7oI4kA=; b=Kq3vZx1aR8mP2nT5wY9cL4bF7hD0jG3sK6vX1zQ8pM5tN2rW9yC4uE7iA0oB3fH6
X-Google-Smtp-Source: AGHT+IGx3vR8pL2mK9nQ5wT1yZ7cB4dF0hJ6sA3eU8oI2kM5rN9tX1vY7wC4qP0
X-Received: by 2002:a17:906:3b92:b0:a9a:1c2e:4d10 with SMTP id u18mr2145678ejf.133.1792161733512; Fri, 16 Oct 2026 07:42:13 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:7208:3184:b0:9f:5b0e:1a2b with HTTP; Fri, 16 Oct 2026 07:41:32 -0700 (PDT)
From: Jane Cooper <[email protected]>
Date: Fri, 16 Oct 2026 16:41:31 +0200
Message-ID: <[email protected]>
Subject: Northwind's carrier onboarding
To: Dana Whitfield <[email protected]>
Content-Type: multipart/alternative; boundary="000000000000a1b2c3d4e5f60718"

Next

Email me this report
The verdict, every authentication result, the route and the fixes. Results only: the headers, addresses and subject line stay in your browser.
Every check with its resultFixes worst firstNo headers in the email
One email with the report. No sequence, no sales call.
Ken checks this on every inbox it sends from.
Add your domains and Ken watches DNS, blacklists and bounce rates for you, and pauses an inbox before it does damage.
Start free - 1,000 credits, no card

What the header analyzer does

Every email carries headers that record its route and how each server judged it. Paste them here and the analyzer lays out the Received chain hop by hop with the delay at each step, reads the Authentication-Results for SPF, DKIM, DMARC and ARC, and pulls out spam verdicts such as SpamAssassin's X-Spam-Status and Microsoft's SCL and BCL.

Parsing happens in your browser. The headers never leave your device, which matters because they contain email addresses and server names.

How to get the headers

  • Gmail: open the message, click the three-dot menu, choose Show original, then Copy to clipboard.
  • Outlook on the web: open the message, click the three-dot menu, then View and View message details.
  • Classic Outlook for Windows: open the message, then File, Properties, and copy the Internet headers box.
  • Apple Mail: View, Message, All Headers, or Raw Source for the full message.
  • Yahoo Mail: open the message, click More, then View raw message.

How to read the result

Each server adds its Received header at the top, so the analyzer reads them bottom up to follow the message from sender to recipient. A long delay on one hop points at a queue or a greylisting server. A negative delay usually means a server clock is off.

Trust the Authentication-Results header added by the receiving provider, the one nearest the top. Headers further down can be added by anyone along the way, including the sender.

On Microsoft mail, SCL runs from -1 to 9, and 5 or higher generally means filtering judged the message as spam. In Microsoft 365 the verdict itself sits in the SFV and CAT values of the X-Forefront-Antispam-Report header. BCL runs from 0 to 9 and rates how much the sender looks like bulk mail that draws complaints.

Why it matters for cold email

When you send a test into your own Gmail and Outlook inboxes, or a prospect forwards a message back, the headers answer the questions that matter. Did DKIM pass with your domain or the tool's? Did DMARC align? Did a server add hours of delay? Did Microsoft give the message a high BCL?

Use it on seed tests and on junked messages. It's the fastest way to tell whether a problem is authentication, reputation or the route the message took.

Questions

How do I read email headers?
Start at the bottom Received line and move up, which follows the message from sender to recipient. Then find the Authentication-Results header added by the recipient's provider. It says whether SPF, DKIM and DMARC passed, and for which domains.
What do spf=pass, dkim=pass and dmarc=pass mean?
spf=pass means the sending IP is allowed by the SPF record of the smtp.mailfrom domain. dkim=pass means a signature verified, and header.d shows which domain signed. dmarc=pass means at least one of those passed for a domain aligned with the From address.
Is it safe to paste email headers here?
Yes. The analyzer runs in your browser and doesn't upload the headers. If you email yourself the report, it holds the results only: domains, verdicts and the route, never the headers, addresses or subject line. Headers contain addresses, so be careful pasting them into tools that send them to a server.
What is ARC in email headers?
Authenticated Received Chain, defined in RFC 8617. When a mailing list or forwarder changes a message and breaks SPF or DKIM, its ARC headers record the authentication results it saw before the change. Receivers that trust that forwarder can use them to accept the message.
Why did my email go to spam when SPF, DKIM and DMARC passed?
Authentication proves who sent the message, not that the recipient wants it. Spam placement also comes from domain and IP reputation, complaint history, content and volume. Look for spam headers such as X-Spam-Status or Microsoft's SCL and BCL to see what the filter scored.

More in Deliverability

30 tools.