Email header analyzer
Paste the headers of any email to see each hop and its delay, the SPF, DKIM, DMARC and ARC results, and the spam scores.
Authenticated, with warnings
SPF passDKIM passDMARC passThis email authenticated as northwind-outbound.com and Google Workspace did not flag it. SPF and DKIM passed for the From domain, so DMARC passed (policy p=none). It arrived 43 s after it was sent, over 3 hops. 1 thing to tidy up below.
Needs attention
1 finding, worst first.4 passed, 1 for informationNothing to do here. Open it to see the evidence for each one.SPF passed and alignedDKIM passed and alignedTLS on the way inDelivered in 43 sNo List-Unsubscribe headerShowHide
Route
Read bottom up in the raw headers. Hop 1 is the sender's first server, the last hop is the mailbox.Authentication results
As written by mx.google.com, the top Authentication-Results header. Headers further down can be added by anyone on the way.Spam and filter headers
No filter wrote a verdict into this copy. Gmail and Yahoo usually don't, so check the folder it landed in.Message
The identity headers. They stay on this page and never go in the emailed report.All 21 headersIn the order they appear, top to bottom.ShowHide
Next
What the header analyzer does
Every email carries headers that record its route and how each server judged it. Paste them here and the analyzer lays out the Received chain hop by hop with the delay at each step, reads the Authentication-Results for SPF, DKIM, DMARC and ARC, and pulls out spam verdicts such as SpamAssassin's X-Spam-Status and Microsoft's SCL and BCL.
Parsing happens in your browser. The headers never leave your device, which matters because they contain email addresses and server names.
How to get the headers
- Gmail: open the message, click the three-dot menu, choose Show original, then Copy to clipboard.
- Outlook on the web: open the message, click the three-dot menu, then View and View message details.
- Classic Outlook for Windows: open the message, then File, Properties, and copy the Internet headers box.
- Apple Mail: View, Message, All Headers, or Raw Source for the full message.
- Yahoo Mail: open the message, click More, then View raw message.
How to read the result
Each server adds its Received header at the top, so the analyzer reads them bottom up to follow the message from sender to recipient. A long delay on one hop points at a queue or a greylisting server. A negative delay usually means a server clock is off.
Trust the Authentication-Results header added by the receiving provider, the one nearest the top. Headers further down can be added by anyone along the way, including the sender.
On Microsoft mail, SCL runs from -1 to 9, and 5 or higher generally means filtering judged the message as spam. In Microsoft 365 the verdict itself sits in the SFV and CAT values of the X-Forefront-Antispam-Report header. BCL runs from 0 to 9 and rates how much the sender looks like bulk mail that draws complaints.
Why it matters for cold email
When you send a test into your own Gmail and Outlook inboxes, or a prospect forwards a message back, the headers answer the questions that matter. Did DKIM pass with your domain or the tool's? Did DMARC align? Did a server add hours of delay? Did Microsoft give the message a high BCL?
Use it on seed tests and on junked messages. It's the fastest way to tell whether a problem is authentication, reputation or the route the message took.