Paste the raw headers of any email and see the path it took, the delays, and whether SPF, DKIM and DMARC passed. Parsing happens in your browser, so your headers never leave your machine.
Loading tool…
Lower stack cost. Back in the inbox. Built to send at any scale.
We rebuild it properly: secondary domains, inboxes, SPF, DKIM and DMARC set to enforcement, warmup and safe sending limits, blacklist monitoring on top. Send-ready in about 17 days. No campaigns, no copy, no lead lists. Infrastructure only.
Almost a decade building cold outreach infrastructure, including his own sending and verification stack built from scratch. 20+ B2B clients at companies worth $10M and above, all in tier one countries.
Free · Written plan + fixed price · No sales call required
Every email carries a block of headers at the top of the message. A few are visible, like From, To, Subject and Date. The rest are added by the servers that handle the message on its way to you. Each server stamps the message with a Received line that records where the message came from, which server took it, and the exact time. Together these lines form a full record of the path the email took, and the Authentication-Results header records whether SPF, DKIM and DMARC passed when the message arrived.
Gmail: open the message, click the three dot menu next to the reply button, and choose Show original. A new page shows the full headers. Copy everything from the top down to where the message body starts.
Outlook on the web: open the message, click the three dot menu at the top of the message, choose View, then View message details, and copy the full text shown. In the Outlook desktop app, open the message, go to File, then Properties, and copy the text in the Internet headers box.
Apple Mail: open the message, go to the View menu, choose Message, then Raw Source, and copy the full text shown.
Read the chain from the bottom up. The lowest Received line is the first server that handled the message, usually the sender's own mail server. Each line above it is one more hop, and the top line is the final delivery by your mailbox provider. Every hop shows a from host, a by host, and a timestamp. The gap between one timestamp and the next is the delay at that step, and this tool works it out for you. A message that spent minutes or hours at one hop sat in a queue at that server, often because of greylisting, a busy server, or a retry after a failed first attempt.
When a message arrives, the receiving server checks the sending domain and writes the verdicts into an Authentication-Results header. spf=pass means the sending IP was allowed by the SPF record of the envelope sender domain. dkim=pass means a valid DKIM signature matched the signing domain. dmarc=pass means SPF or DKIM passed and the domain matched the visible From domain. A fail on any of them is a warning sign, and this tool shows each result exactly as written in the header, never guessed. To check the records behind these results, run the Domain Health Checker for the full picture, test your message content with the Email Spam Checker, and review your policy with the DMARC Checker.
For a late email, find the hop with the big delay. The server named in that hop held the message, so that is where you ask questions. For a suspicious email, compare the From name with the domains in the Authentication-Results header and with the originating IP. A message that claims to be from your bank but shows dmarc=fail, or starts from an IP in an unrelated network, is not what it claims to be. Remember that a sender can fake the oldest Received lines at the bottom of the chain, but they cannot fake the lines added by your own provider at the top, because those are written after the message arrives. Trust the chain from your provider's stamp onward.
No. Parsing happens in your browser, and your headers never leave your machine. Nothing you paste is sent to a server, stored, or logged.
The originating IP is the first public IP address in the Received chain. It belongs to the server or device that first handed the message into the mail system, and it is the address receivers check against blacklists and reputation lists.
A delay means the message waited at that server before moving on. Common causes are greylisting, a busy or throttled server, a temporary failure that forced a retry, or a queue on the receiving side. A few seconds is normal. Minutes or hours point at the server named in that hop.
It is the receiving server's written record of the checks it ran when the message arrived. It shows the result for SPF, DKIM and DMARC, each as pass, fail, or another value such as none or softfail, exactly as the receiving server found it.
Open the message, click the three dot menu beside the reply arrow, and choose Show original. Copy the header block from the top of the page that opens and paste it here.
Partly. A sender can add fake Received lines at the bottom of the chain and can write any From name they like. They cannot fake the lines added by your own provider at the top, because those are written after the message arrives. Read the chain from your provider's stamp and treat everything older with care.
A Message-ID is a unique identifier the sending system gives to one message, written in angle brackets. Providers use it to track a single message through their logs, so quote it when you ask a provider to trace a delivery problem.
Yes. This analyzer is free and needs no sign up.
It covers what is broken, what we would build, the timeline, and one fixed price. Want it walked through instead? Book a 15 minute plan walkthrough.
Or just reply to the plan email. Either works.
