Skip to content
fixyour.page

Email Header Analyzer

Trace delivery, authentication, and delays from raw message headers.

Your data stays in your browser
Paste raw email headers. We'll trace delivery, auth, and delays.

Related Tools

SPF Checker

Check a domain's SPF record. Follows every include and counts the 10-lookup limit.

Use tool →

DMARC Checker

Check a domain's DMARC policy. Tags explained in plain English, reporting verified.

Use tool →

SPF, DKIM & DMARC Generator

Generate SPF, DKIM, and DMARC DNS records for Google Workspace, Microsoft 365, or custom setups.

Use tool →

Email Compatibility

Check HTML email code for rendering issues across Gmail, Outlook, and Apple Mail.

Use tool →

How to Analyze Email Headers

Open the email you want to investigate and find the raw headers. In Gmail, click the three dots menu and choose "Show original." In Outlook, open message properties. Copy the full header text and paste it above. The analyzer traces every server hop your message took, checks SPF, DKIM, and DMARC authentication, and flags any delays or issues in the delivery chain.

If you've used Microsoft's Message Header Analyzer or Google's Admin Toolbox Messageheader, this is the same job without the ecosystem lock-in. Paste headers from any client, analyze any message. Nothing gets uploaded, because the parsing happens in your browser.

What Email Headers Tell You

Every email carries a trail of metadata that records its journey from sender to recipient. Each server that handles the message adds a "Received:" header with its name, IP address, and timestamp. Reading these headers reveals the complete delivery path, how long each hop took, and whether the message was delayed, rerouted, or relayed through unexpected servers. This is essential for diagnosing delivery problems, identifying spoofing attempts, and understanding why emails end up in spam.

Understanding SPF, DKIM, and DMARC

SPF verifies that the sending server's IP address is authorized by the domain's DNS records. DKIM adds a cryptographic signature to the message that proves it wasn't altered in transit. DMARC ties SPF and DKIM together with a domain policy that tells receiving servers what to do when authentication fails. All three working together is the standard for legitimate email delivery. When any of them fails, the message is more likely to be flagged as spam or rejected entirely.

Reading a Failed Authentication-Results Line

The Authentication-Results header is where the receiving server writes down its verdict. A healthy one looks like spf=pass dkim=pass dmarc=pass. When something's off, the failure names the fix.

spf=softfail means the sending IP isn't in the domain's SPF record. Common after adding a new sending service without updating DNS. Check the record with our SPF Checker, which also counts the 10-lookup limit that silently breaks overloaded records. dkim=fail usually means the signature didn't verify: either the message was modified in transit (footers appended by mailing lists do this constantly) or the DNS key doesn't match. Look up the key with the DKIM Checker. dmarc=fail means neither SPF nor DKIM passed in alignment with the From domain, and the domain's policy decides what happens next. See what that policy actually says with the DMARC Checker.

What is a message header analyzer? +
The same thing as an email header analyzer. Microsoft calls theirs Message Header Analyzer, Google calls theirs Messageheader, and everyone means the same tool: paste the raw headers from an email, get back the delivery path, authentication results, and timing. This one runs entirely in your browser and doesn't need an account.
How do I find email headers? +
In Gmail, open the message, click the three-dot menu in the top right, and select "Show original." You'll see the full headers at the top of the page — copy everything before the message body. In Outlook desktop, open the message, go to File > Properties, and the headers are in the "Internet headers" box. In Apple Mail, choose View > Message > All Headers. Every email client buries headers somewhere different, but the data is always there.
What do SPF, DKIM, and DMARC mean? +
SPF (Sender Policy Framework) checks if the sending server is allowed to send on behalf of the domain. DKIM (DomainKeys Identified Mail) verifies the message hasn't been tampered with using a cryptographic signature. DMARC (Domain-based Message Authentication, Reporting, and Conformance) combines both and adds a policy for what to do when checks fail. Together they prevent email spoofing and improve deliverability.
Why is my email delayed? +
Delays between hops usually point to server queues, greylisting (a spam prevention technique that intentionally delays first-time senders), DNS lookup timeouts, or overloaded mail servers. The header timestamps show you exactly where the delay happened. A delay at the first hop often means the sending server queued the message. A delay at the last hop usually means the receiving server was slow to accept it.
How many hops should an email have? +
Most emails travel through 3 to 7 hops. Direct delivery between two well-configured mail servers might be as few as 2-3. Messages that pass through mailing lists, forwarding rules, or spam filters add extra hops. More than 10 hops is unusual and might indicate excessive forwarding, misconfigured relays, or mail loops. The number alone isn't a problem — it's the delays and routing that matter.
Can I check my SPF, DKIM, and DMARC records here? +
This tool shows you the authentication results a receiver recorded for one specific message. To check the DNS records behind those results, use our SPF Checker, DKIM Checker, and DMARC Checker. They query your live DNS from your browser and validate the records themselves, which is where you fix a fail you found here.
↑ Back to top