Email headers are the delivery receipt that travels with every message. They record each server that handled the message, when it did so, whether the connection was encrypted and what the receiving server concluded about SPF, DKIM and DMARC. When a message lands in spam or arrives hours late, the headers usually tell you why.
Raw headers are hard to read. This analyzer parses them in your browser and lays out the story in order, from the first server to the inbox.
How to get raw headers
You need the full header block, not just the From and Subject shown in your mail app.
| Client | Steps |
|---|---|
| Gmail (web) | Open the message, click the three-dot menu next to Reply, choose Show original, then Copy to clipboard |
| Outlook (classic desktop) | Open the message in its own window, go to File, then Properties, and copy the Internet headers box |
| Outlook (new app and web) | Open the message, click the three-dot menu, choose View, then View message source (or View message details) |
| Apple Mail | Select the message, then View, Message, All Headers, or use Raw Source (Option-Command-U) |
| Yahoo Mail | Open the message, click the three-dot More menu, choose View raw message |
Paste everything from the top down to the first blank line. Including the body does no harm, but the analyzer only needs the headers.
What the analyzer shows
Hops in order. Each Received header becomes a numbered hop with the sending host, receiving host, IP address, timestamp, delay since the previous hop and whether TLS was used.
Authentication verdicts. SPF, DKIM and DMARC results pulled from the Authentication-Results header written by the receiving server.
Alignment. The domain in the DKIM d= tag and the Return-Path domain, each compared with the visible From domain. This is what decides whether DMARC can pass.
Unsubscribe headers. Whether List-Unsubscribe is present and whether List-Unsubscribe-Post: List-Unsubscribe=One-Click supports one-click unsubscribe, which Gmail and Yahoo require for bulk mail.
Key headers. From, To, Subject, Date, Message-ID, Return-Path, Reply-To and any spam-scoring headers the receiver added.
Reading the Received chain
Here is a trimmed example, shown the way it appears in raw form (newest first):
Received: from mail-a12.esp.example (mail-a12.esp.example [198.51.100.40])
by mx.google.com with ESMTPS id x7si123
for <jane@gmail.com>; Tue, 15 Sep 2026 09:14:07 -0700
Received: from app-queue-3.internal (10.0.4.18)
by mail-a12.esp.example with ESMTP; Tue, 15 Sep 2026 16:14:05 +0000Reading from the bottom up: the message left an internal queue, was handed to the ESP’s outbound server 198.51.100.40, then delivered to Google over TLS two seconds later. The IP on the first hop into the receiving organisation (198.51.100.40) is the one that receivers judge, and the one to test with the blacklist checker and reverse DNS checker.
What to look for:
- Delays. Seconds are normal. Minutes or hours point to deferrals or a slow gateway.
- Missing TLS.
ESMTPwithout theSbetween organisations means an unencrypted hop. - Too many hops. More than eight to ten can signal forwarding loops or relays hiding the origin.
- Unexpected hosts. A server you do not recognise before your ESP may mean a forwarding rule or a compromised system.
Understanding authentication results
A typical Authentication-Results line:
Authentication-Results: mx.google.com;
dkim=pass header.i=@news.example.com header.s=s1 header.b=Ab12Cd;
spf=pass (google.com: domain of bounce@em.example.com designates 198.51.100.40 as permitted sender) smtp.mailfrom=em.example.com;
dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com| Result | Meaning | If it fails |
|---|---|---|
| spf=pass | The sending IP is authorised by the Return-Path domain’s SPF record | Add the service to SPF, check the lookup count with the SPF checker |
| dkim=pass | The signature verified with the published key for that selector | Check the key at the s= selector with the DKIM checker |
| dmarc=pass | SPF or DKIM passed and aligned with the From domain | Fix alignment, then review policy with the DMARC checker |
In the example, all three pass and both the DKIM domain (news.example.com) and the Return-Path domain (em.example.com) align with example.com under relaxed alignment.
X-Forefront-Antispam-Report and spam confidence level (SCL) headers that show how its filter rated you.
Spotting spoofing and misconfiguration
Most header investigations fall into one of these patterns.
DMARC fails despite SPF pass. SPF passed for the ESP’s own bounce domain, not yours, and DKIM is signed with the ESP’s domain. Nothing aligns. Configure a branded Return-Path and DKIM on your domain in the ESP settings.
DKIM fails with “body hash did not verify”. Something changed the message after signing: a footer added by a gateway, a mailing list or a link rewriter. Sign after modifications, or rely on ARC headers from forwarders.
From and Reply-To differ, plus an SPF fail. Classic phishing. Legitimate senders can use a different Reply-To, but combined with failed authentication it is a strong warning.
No List-Unsubscribe on marketing mail. Since February 2024 Gmail and Yahoo expect one-click unsubscribe on bulk mail. Missing it will not always cause spam placement, but it removes an easy way for recipients to leave without pressing the spam button.
When to use header analysis
Use it whenever you need facts rather than guesses: a customer says your email went to junk, a warmup campaign is underperforming, a new ESP was just connected or a suspicious message arrived. For persistent spam placement, pair it with our walkthrough of why emails go to spam and the email authentication guide.