Every email carries a hidden record of its journey. Each server that handles a message adds a line saying where it came from, where it went and when, and the receiving server adds the results of its security checks. Those lines, called headers, answer questions the message itself cannot: whether it really came from the sender it claims, why it landed in spam and where it was held up. The analyzer above turns pasted headers into a readable delivery path, an authentication summary and a list of anything unusual.

What Email Headers Are

An email has two parts: the body you read, and a block of headers above it that most email programs hide. Some headers are written by the sender’s program, such as From, To, Subject and Date. Others are added along the way, mainly the Received lines, one per server, and the Authentication-Results line, which records whether the message passed SPF, DKIM and DMARC.

Because each server adds its Received line to the top, the headers read backwards. The first Received line is the last step in the journey, and the bottom one is closest to the sender. The analyzer reverses them, so the delivery path reads in order from start to finish.

What This Tool Shows

Paste the full headers and the analyzer reports:

• Whether the message passed SPF, DKIM and DMARC, and for which domains
• Every server in the delivery path, with the time between each step
• The sending server’s address, which you can check on our Email Blacklist Check
• The sender, recipient, subject, date, return path and reply-to address
• The program that sent the message, any spam filter verdict and whether it includes an unsubscribe link

A What to Know box points out anything worth attention, such as a failed check, a reply-to address on a different domain or a step that took more than five minutes.

How to Find Email Headers

Each email program hides headers in a different place. In Gmail, open the message, click the three dots next to Reply and choose Show original, then copy the text above the message. In Outlook on the web, open the message, click the three dots, choose View and then View message details. In Outlook for Windows, open the message in its own window, choose File, then Properties, and copy the Internet headers box. In Apple Mail, choose View, Message, All Headers. In Yahoo Mail, open the message, click the three dots and choose View raw message.

Copy everything from the first header line down to the start of the message text. It is fine to include more than you need, since the analyzer stops reading at the first blank line after the headers.

SPF, DKIM and DMARC Explained

These three checks work together to confirm that a message really comes from the domain it claims. SPF checks whether the server that sent the message is on the sending domain’s list of approved servers. DKIM checks a digital signature added by the sender’s email service, which proves the message was not changed and links it to a domain. DMARC ties the two together. It checks that SPF or DKIM passed for the same domain shown in the From line, and tells receiving servers what to do with messages that fail.

A pass on DMARC is the strongest sign that a message is genuine. A failure means either the message is forged, or the sender’s setup is missing a service that sends on its behalf. If the domain is yours, our SPF, DKIM and DMARC checkers show what to fix.

Spotting Phishing in Headers

Headers often reveal a phishing message that looks convincing on the surface. Warning signs include a failed DMARC check for a well-known company, a reply-to address on a different domain from the sender, so your reply goes somewhere else, and a sending server that has nothing to do with the company named in the From line. A message from a bank that was sent by a home internet connection in another country deserves suspicion.

None of these signs is proof on its own. Many legitimate newsletters use a sending service with its own return path, and some companies reply from a support system on a different domain. Look at the overall picture, and when in doubt, contact the company through its own website rather than the email.

Why an Email Was Delayed

Each step in the delivery path shows how long it took since the step before. Most messages pass through every server in a few seconds. A step of several minutes or more usually means one of three things: the receiving server was busy and asked the sender to try again later, the message was held for a spam or virus scan, or a server along the way was having problems.

Delays inside the receiving company’s own network are common too. Large providers pass each message through several internal servers for filtering and storage, and those steps can add a few seconds each without any problem.

Times come from each server’s own clock, so small differences, or even a step that appears to go backwards by a few seconds, are normal. Large gaps are what matter.

Why an Email Went to Spam

When a message lands in spam, the headers often explain why. Look first at the authentication results, since a failed SPF, DKIM or DMARC check is one of the most common reasons. Then check for a spam filter line, which some providers add with a score or a list of rules that matched. Finally, check the sending server on our Email Blacklist Check, since a listing there can push otherwise good mail into spam.

Big providers such as Gmail and Outlook also weigh things headers do not show, such as how often recipients open or delete a sender’s messages. If everything in the headers passes, the cause is more likely the content or the sender’s reputation.

Your Headers Stay Private

Headers can contain email addresses, server names and internal network details, so this analyzer runs entirely in your browser. Nothing you paste is sent to Domibot or any other service, and nothing is saved. Closing or reloading the page clears it completely.