Email Header Analyzer.

Open the message and use your mail app's show original or message source option, then copy everything from the top down to the first blank line. In Gmail, use the three-dot menu, then Show original. In Outlook on the web, use More actions, then View, then View message details. In Outlook for Windows, use File, then Properties. In Apple Mail, use View, then Message, then All Headers. In Thunderbird, use View, then Message Source. Use the copy you received, because the sender's copy has no delivery trace.

Read the Received lines from the bottom up: the lowest one is the first server the message left, and the top one is the final delivery. Each line names the server that handed the message over, the one that accepted it, and a timestamp. Then find the Authentication-Results line added by your own provider, which records the SPF, DKIM and DMARC results. This analyzer puts the hops in delivery order and works out each delay for you.

They are the receiving server's verdicts on whether the message really came from the domain it claims. SPF checks that the sending server's IP is allowed by the bounce (Return-Path) domain. DKIM checks a cryptographic signature from the domain in d=. DMARC passes when SPF or DKIM passes for a domain that matches the From address. Results include pass, fail, softfail, neutral, none, temperror and permerror, and the analyzer shows them exactly as the server wrote them.

Both mean the sending IP is not authorised in the domain's SPF record; the difference is how strongly the domain asks receivers to act. A softfail, from ~all, says the message is probably not authorised, and receivers usually accept it with suspicion. A fail, from -all, says the IP is definitely not authorised. Under DMARC either one can be outweighed: if DKIM passes for a domain that aligns with From, DMARC passes.

The delay sits on the hop where the gap between two Received timestamps is largest. Each server stamps the time it accepted the message, so subtracting each timestamp from the next shows how long that step took. Long gaps usually come from a queue on the sending side, greylisting, where the receiver asks the sender to retry later, or a slow content scan. A negative gap means two servers' clocks disagree, and the analyzer shows it as negative instead of hiding it.

Yes. A sender can write any From, Date or Received line before the message leaves, so trust only what your own provider added: its Received line and its Authentication-Results line at the top of the header. Signs of spoofing are a DMARC fail in that result, a From domain that matches neither the DKIM d= domain nor the Return-Path domain, and an Authentication-Results line further down that claims your provider's name. The analyzer marks which result belongs to the receiving server.

Look at the oldest Received line added by your own provider's servers: the IP in its from part is the address that connected to your provider. Lines below it were written by servers outside your provider and cannot be verified. Large webmail services often leave out the IP of the sender's own device, so the earliest public IP is usually the sending service's server, not a person's computer. The analyzer names this address when the headers make it clear.

It means the message body changed after the sender signed it, so the signature no longer matches. Common causes are a mailing list adding a footer, a security gateway rewriting links, or a forwarder re-encoding the message. The signature itself can still be well formed. If the message carries ARC headers, the first ARC set shows the results the forwarding server saw before it made the change, which is how receivers can still accept forwarded mail.

Headers contain email addresses, server names and IP addresses, but no message text, and if you paste a whole message the body is removed in your browser before anything is sent. We keep the result for 90 days with email addresses and IP addresses masked, along with your own IP address and browser, to prevent abuse. Signature verification, which needs the full message, is off unless you switch it on.