Where Has Your Email Been? Read Its Headers.

Analyze your email headers

Paste the raw internet headers of an email below (everything above the first blank line of the message). The analyzer traces the Received path hop by hop, pulls the SPF, DKIM and DMARC verdicts from Authentication-Results, and flags the red flags that matter for deliverability and spoof detection. It also computes a 0-100 health score with recommended actions matched to the checks that failed.

See authentication failures you can't explain? Have a specialist double-check them — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.

What the analyzer reads

1. The Received chain — every hop the message passed through, in order, with the sending and receiving host of each. The analyzer also reads each hop's timestamp to time every leg of the journey and name the slowest one: the relay that sat on the message. Long chains and unknown relays are the signature of forwarded or laundered mail.
2. Authentication-Results — the SPF, DKIM and DMARC verdicts your receiving server recorded at delivery time. Fail here is why the message went to spam — or why a spoofed From line should not be trusted.
3. From vs Return-Path vs Reply-To — mismatches between the visible sender, the envelope sender, and the reply address are the classic anatomy of a spoofed message.
4. Message-ID and Date — missing or malformed identifiers and dates that do not parse are common in automated spam and phishing toolkits.
5. Spam-score headers — if your receiving server stamped a spam verdict, the analyzer reads the number itself. SpamAssassin's X-Spam-Status pairs a score against the server's own threshold and lists the rules that fired, while Microsoft stamps its own SCL/BCL/PCL values. Gmail and most consumer providers stamp no score, which is normal.
6. Health score and recommendations \u2014 a 0-100 composite of the findings above, with concrete next steps matched to whatever failed.

Why the hop count matters

Every legitimate message picks up a Received stamp at each server that touches it. A normal path has two to five hops: sender, the sender's provider, maybe a filter, your provider, your inbox. Chains far longer than that usually mean forwarding loops, compromised relays, or deliberate laundering. The analyzer counts the hops and calls out chains that look relayed rather than sent.

Authentication is what makes the path trustworthy. Run the Free Email Domain Trust Checker to see where your own domain stands on SPF, DKIM, and DMARC.

Verify the rest of the set

The analyzer reads what receivers saw. Publish the records that make senders trust you, free, in your browser:

• Free SPF Record Generator
• Free SPF Record Checker
• Free DKIM Record Generator
• Free DKIM Record Checker
• Free DMARC Record Generator
• Free DMARC Record Checker
• Free BIMI Record Generator
• Free BIMI Record Checker
• Free MTA-STS Record Generator
• Free TLS-RPT Record Checker
• Free MX Record Checker
• Free Email Domain Trust Checker

Prefer done-for-you?

If you'd rather hand this to a specialist, submit your domain for the Email Domain Trust Audit — a fixed-output report with risk notes and prioritized next steps. When records are broken and you want them fixed, the 99 Mailbox Rescue gets them fixed within 48 hours, zero tech touch.

Frequently asked questions

What does the email header analyzer do? You paste the raw internet headers of an email (the hidden routing block above the message body). The analyzer unfolds them, lists every Received hop in order, extracts the SPF, DKIM and DMARC verdicts from Authentication-Results, and flags deliverability red flags — all in your browser, nothing uploaded.

How do I get the raw headers of an email? In Gmail, open the message, click the three dots, then Show original, and copy the block at the top. In Outlook, open the message, then File, then Properties, and copy Internet headers. In Apple Mail, select the message and choose View, then Message, then All Headers.

What do the Received headers tell me? Each Received header is one hop the message passed through, stamped by the receiving server. Read top-down (newest first) to trace the full path from the sender's server to your inbox. Unusual hops — unknown hosts, long chains, big time gaps — are where spoofed and relayed mail gives itself away.

Why do SPF, DKIM and DMARC verdicts matter in headers? The Authentication-Results header records what your receiving server concluded when the message arrived: whether SPF passed, whether DKIM signatures verified, and whether DMARC alignment held. A From line that looks legitimate but carries SPF fail and DMARC fail is forged — the headers prove it even when the visible email does not.

Is it safe to paste email headers into the analyzer? Yes — the analyzer is pure client-side JavaScript. The parsing runs entirely in your browser; nothing is sent to any server. Headers can contain internal hostnames and IP addresses, so never paste them into a tool that uploads them — this one does not.

Why did my email take so long to arrive? Paste the headers and the analyzer reads the timestamp each receiving server stamped on its Received header. It times every leg of the journey, names the slowest one, and flags any leg that held the message 30 minutes or more. That pattern usually means greylisting, a full mail queue, or a stalled relay. The total end-to-end time is reported too, so you can tell at a glance whether the delay was one bad hop or a slow chain.

Why did my email go to spam? Paste the headers and the analyzer reads the spam score your receiving server stamped, if any. SpamAssassin-style X-Spam-Status shows the score next to the server's own threshold, plus the rules that fired. Microsoft stamps its own values instead: SCL 6 and up goes to spam, PCL 6 and up means phishing heuristics. Gmail and most consumer providers stamp no score at all; when those headers are absent, the verdicts rest on the SPF, DKIM, and DMARC results.

What does the 0-100 health score mean? After the analysis, the tool reduces its findings to one 0-100 health score: every failed check costs 15 points and every warning costs 7. A score of 90 or above is Excellent, 75-89 is Good, 50-74 is Suspicious, and below 50 is Untrustworthy. Each score ships with recommended actions matched to the checks that failed \u2014 for example, fixing SPF when SPF fails \u2014 and scores under 70 link to the Email Domain Trust Audit, since low scores usually mean authentication problems at the source.