Email Header Analyser
A message landed in junk, or bounced, and you want to know why. Paste its headers below and this reads what the receiving server recorded about SPF, DKIM and DMARC, works out whether each one lined up with the From address, and tells you what to fix. It runs entirely in your browser: the headers are never uploaded anywhere.
Where to find a message's headers
Use the copy that arrived in the recipient's inbox, not the one in your Sent folder: the results are added by the server that receives the message.
- Gmail: open the message, choose the three-dot menu, then Show original, and Copy to clipboard.
- Outlook on the web: open the message, choose the three-dot menu, then View and View message source.
- Outlook for Windows: open the message in its own window, then File, Properties, and copy the Internet headers box.
- Apple Mail: select the message, then View, Message, All Headers.
What this reads
-
The receiving server's
Authentication-Resultsheader: its SPF, DKIM and DMARC verdicts, as Gmail, Microsoft 365, Yahoo and others record them. - Alignment: whether the domain SPF passed for, and the domain that signed with DKIM, match the domain in the From address. A pass that doesn't line up counts for nothing in DMARC, and it is the most common reason a message fails (see why SPF and DKIM can pass while DMARC still fails).
- The domain's DMARC policy, when the receiver noted it.
-
The
Receivedlines: each server the message passed through, in order, and how long it waited at each.
It reads the receiver's verdicts; it doesn't re-run them. A DKIM signature can't be checked without the whole message, and SPF can't be re-run without the original connection, so a tool that claims to from headers alone is guessing. To check what a domain publishes right now, use the Domain Checker.
Nothing here is uploaded, logged or sent anywhere. Headers carry names, addresses and server details, which is why this page makes no network request with them.
What the results usually mean, and the fix
- SPF and DKIM both passed, but DMARC failed
- They passed for the sending service's own domain, not yours. In that service's settings, authenticate your domain (a custom or branded sending domain) so it signs with DKIM as you.
- SPF failed on a message that was forwarded
- Expected: the forwarder's server isn't in your SPF record, and shouldn't be. A DKIM signature from your own domain survives forwarding, so make sure every sender signs with one.
- DKIM failed after a mailing list
- Lists that add a footer or a subject tag change the message, which breaks the signature. That is the list's doing, not a fault in your DNS.
- DMARC passed, on SPF alone
- It works until the message is forwarded. Turn on DKIM signing for your domain at that sender so a forwarded copy still passes.
- No DMARC result at all
- Either the headers came from a Sent folder, where no receiver has judged the message, or the From domain publishes no DMARC record.
Email header questions
Are my headers uploaded?
No. They are read in your browser, and the page makes no network request with them. Nothing you paste is sent to us, logged or stored.
What is the Authentication-Results header?
The line a receiving mail server adds to say what it found when it checked the message: whether SPF and DKIM passed and for which domains, and whether DMARC passed for the From domain.
What does alignment mean?
DMARC only counts an SPF or DKIM pass when the domain it passed for matches the domain in the From address. A subdomain counts unless the record asks for a strict match.
Why is there no result in the headers I pasted?
The results are added by the server that receives a message. A copy from your Sent folder never went through one, so open the message as it arrived in an inbox and copy its headers from there.
Does this verify the DKIM signature itself?
No. Verifying needs the whole message as it was sent, not only its headers. This reads the verdict the receiving server recorded, which is the one that decided where the message went.
Can I see this for all my mail, not one message?
That is what DMARC aggregate reports are for: receivers send a daily count of every message using your domain and whether it passed. DMARCLoop reads them and names each sender.