Email Header Analyzer

Email headers are metadata attached to every message that show its complete journey from sender to recipient. They reveal: the originating server and IP, every server the message touched on its way, authentication results (SPF, DKIM, DMARC), how long delivery took at each hop, the sender’s claimed domain versus the actual sending server, the message’s unique ID, and a host of vendor-specific anti-spam scores and flags.

For deliverability troubleshooting, headers tell you where messages are getting stuck. For phishing investigation, they reveal whether a sender’s claimed identity matches the actual source. For compliance, they prove a message’s path and authenticity.

SPF (Sender Policy Framework) validates that the IP address that sent the message is authorized to send for the sender’s domain. Looks up a TXT record on the sender’s domain to check.

DKIM (DomainKeys Identified Mail) uses a cryptographic signature on the message itself to prove it hasn’t been tampered with in transit and was actually signed by the sender’s domain.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together and tells receiving servers what to do when they fail (reject, quarantine, or just monitor). DMARC also adds the “alignment” requirement — the SPF or DKIM authenticated domain must match the visible From: domain.

Modern email security uses all three. Want to verify your own domain has them set up correctly? Try our Email Security Checker.

Each server that handles the message adds a Received header as it passes through. A typical email touches 3–5 servers: the sender’s outgoing mail server, possibly an internal relay or anti-spam gateway, the receiving organization’s MX server, possibly an inbound spam filter, and finally the mailbox server. Each adds its own Received header.

The headers are added to the top of the list, so reading down the list goes from most recent (final delivery) to oldest (originating server). The analyzer reverses this and shows the path in chronological order so it reads naturally.

Most hops complete in well under a second. Delays in the seconds-to-minutes range are normal for spam filtering or anti-malware scanning. Delays of 5+ minutes usually indicate the receiving server placed the message in a retry queue — either because of a temporary deliverability problem (greylisting, rate limits) or because the sending server had connectivity issues.

Delays of an hour or more are red flags. They typically indicate persistent deliverability problems, spam-related rate limiting at the destination, or a misconfigured outbound queue at the sender’s end. The analyzer highlights significant delays automatically.

The From: header and most “informational” headers can be spoofed trivially — they’re just text the sender writes. The Received headers added by intermediate servers, however, are added by those servers themselves and are difficult to spoof beyond the originating hop. SPF, DKIM, and DMARC results are added by the receiving server and reflect what that server actually verified.

So when investigating suspicious email, trust the Received headers added by the recipient’s own infrastructure (the most recent ones at the top) and the Authentication-Results header more than what’s in the From: line. If From: says one domain but the SPF and DKIM-checked sending domain are different, that’s a strong phishing indicator.

ARC (Authenticated Received Chain) is a relatively new standard (RFC 8617) that solves a specific problem: when an email is forwarded through a mailing list or other intermediary, the original SPF and DKIM signatures often break, causing legitimate forwarded messages to fail DMARC.

ARC lets each forwarder cryptographically attest “I received this message and these were the auth results when I got it.” The final destination can then trust the chain even if the original SPF doesn’t match anymore. If you see ARC headers, the message has been forwarded through one or more ARC-aware intermediaries — common with Google Groups, Microsoft mailing lists, and corporate forwarding setups.