Email Spam Tester

Free tool

Email Header Analyzer

Paste the headers of a message you received. You get the route it took, how long each hop held it, and what the receiving server decided about SPF, DKIM and DMARC.

Where to find the headers: Gmail ⋮ → Show original · Outlook ⋯ → View → View message details · Apple Mail View → Message → All HeadersTry a sample

Headers contain IP addresses and email addresses. They are read in memory to build the result and are not stored, cached or logged.

Reading the route from the bottom up

Every server that handles a message adds a Received line on top of the ones already there. So the oldest hop is at the bottom and the last one, your own mailbox provider, is at the top. The analyzer turns them into a list in the order the message travelled, with the time each server says it received it and the gap since the previous hop.

A gap of a few seconds is normal. Minutes usually mean the message sat in a queue, because a receiver asked for a greylisting retry, a relay was busy or the sender's own outbound filter held it. Clock going backwards? One of the servers has the wrong time.

Which Authentication-Results to trust

Authentication-Results (RFC 8601) is where a receiving server writes down its SPF, DKIM, DMARC and sometimes ARC verdicts. A message can carry several of these lines, and only the one added by the server that delivered it to you counts. Anything below it was written before your provider got the message, by servers you have no reason to trust, and a sender can put whatever it likes there.

The analyzer takes the topmost one as the verdict and lists the rest separately. Next to it you see the three domains that decide alignment: the From domain, the DKIM d= domain and the Return-Path domain that SPF was checked against. DMARC passes only when SPF or DKIM passes for a domain that matches the From domain, and comparing them is often how a fail gets explained.

Where to find the headers

In Gmail, open the message, click the three dots next to Reply and choose Show original. In Outlook on the web, open the message, choose More actions, then View and View message details. In the Outlook desktop app it is File, then Properties, and the box called Internet headers. Apple Mail has View, Message, All Headers. Copy everything down to the first empty line, which is where the body starts; if you paste the whole message, the body is cut off before the analysis.

Headers contain IP addresses and email addresses. They are read in memory to build the result and are not stored, cached or logged.

Test a real message instead

Each of these tools checks one part of your setup. The full test reads the email itself: send one message to a disposable address and get SPF, DKIM and DMARC as a receiver evaluated them, blocklists, content, both spam scores and a fix plan. Add inbox placement to see the folder it lands in at Gmail, Outlook, Yahoo and other providers.

Test your emailView sample report

Questions

How do I read email headers?

Start at the bottom Received line and move up: that is the order the servers handled the message. Then look at the Authentication-Results line added by your own provider, the topmost one, for the SPF, DKIM and DMARC results.

Why does DKIM pass but DMARC fail?

DMARC needs a passing DKIM signature whose d= domain matches the From domain, or a passing SPF check for a Return-Path domain that matches it. A signature from your sending platform's own domain passes DKIM and still does nothing for DMARC. The analyzer shows the three domains side by side so the mismatch is visible.

Full guide: DMARC fail

What does a long delay between two hops mean?

The message waited on the server where the delay starts. Common causes are greylisting, where the receiver asks the sender to come back later, a full outbound queue, or a filter that scans mail before passing it on. A single delay of a few minutes is rarely a deliverability problem; it explains why a message arrived late.

Can email headers be faked?

Everything a sender writes can be. Received lines below your provider's own and old Authentication-Results lines can be invented. What your provider added at the top cannot, and your provider can check the DKIM signature against the sender's public key. The analyzer does not verify signatures itself; it reads your provider's verdict from the top line.

What is ARC in the headers?

ARC (RFC 8617) lets a forwarding service, such as a mailing list or a forwarding address, record the authentication results it saw before it changed the message. The final receiver can then decide to trust that record when forwarding has broken SPF or DKIM.

Can I test a message before I send it instead?

Yes. Headers only exist once a message has been delivered somewhere. To check a campaign or a transactional email before it reaches anybody, send it to a test address on the home page: you get these results plus blocklists, content, links and the bulk-sender rules in one report.

Common errors

Other free tools

SPF CheckerSyntax, the include chain and the ten-lookup limit.DMARC CheckerPolicy, alignment and who receives the reports.DKIM CheckerThe published key for a selector: type, size and flags.Blocklist CheckerIP and domain blocklists, list by list.Email Header Analyzer You are hereThe route, the delays and the authentication verdict.MX Checker NewMail servers, priorities and broken targets.BIMI Checker NewRecord, logo, certificate and the DMARC policy.