Free tool
Email header analyzer
Paste the headers of any email to see whether SPF, DKIM and DMARC passed and aligned, the exact route it took with the delay at every hop, and what the spam filters decided. It runs entirely in your browser, so your headers are never sent to our servers.
How do I find the headers?
- 1Open the message.
- 2Click the ⋮ (More) menu next to Reply.
- 3Choose “Show original”.
- 4Click “Copy to clipboard” and paste here.
What the analyzer checks
Authentication and alignment
Reads every Authentication-Results,
ARC-Authentication-Results,
Received-SPF and
DKIM-Signature, then checks whether the SPF
MailFrom domain and each DKIM d= domain align with
your From domain — the part most checkers skip.
Delivery route
Parses each Received header into from, by, protocol
and timestamp, orders them oldest first, and shows the delay per hop, the total delivery
time, private IPs, and which hops used TLS.
Sender identity
Flags a Reply-To on another domain, a Message-ID that leaks a hostname, missing Date or Message-ID, and the sending software (X-Mailer, ESP fingerprints).
Unsubscribe and spam verdicts
Checks one-click unsubscribe against RFC 8058 (https URL, the exact
List-Unsubscribe-Post value, DKIM coverage) and
decodes Microsoft SCL/SFV/CAT/BCL and SpamAssassin scores.
How to read email headers
- Read Received headers bottom-up. Every server adds one at the top, so the lowest is where the message started and the top one is the recipient's mailbox server.
- Trust the top Authentication-Results. That's the verdict of the receiving provider. Anything below it may come from internal relays or the sender.
- Compare three domains. The From domain people see, the Return-Path
(SPF checks this one), and the DKIM
d=. DMARC passes only if SPF or DKIM passes for a domain that matches From. - Look for the slow hop. A gap of minutes between two timestamps tells you where mail waited — your sending queue, greylisting, or a scanner.
For cold email, the most common problem we see is a tool sending over SMTP with DKIM signed by the hosting provider's domain instead of yours. Everything "passes" but DMARC fails. If that's you, the SPF, DKIM and DMARC setup guide walks through the fix, and the deliverability checklist covers what to verify before a campaign. New to the topic? Start with deliverability fundamentals.
One limitation: DMARC alignment uses the organizational domain, which receivers look up in
the Public Suffix List. To stay fast and private we use a built-in approximation (last two
labels, or three for suffixes like co.uk and com.au), which is
right for almost every sending domain but can misjudge rare suffixes. The receiver's own
dmarc= result, when present, is always shown as reported.
FAQ
How do I see email headers in Gmail?
Open the message, click the three-dot More menu next to Reply, and choose “Show original”. Gmail opens the full source in a new tab; click “Copy to clipboard” and paste it into the analyzer. In Outlook on the web use … → View → View message source; in Apple Mail use View → Message → All Headers.
Are my email headers uploaded or stored?
No. The analyzer is plain JavaScript that runs in your browser tab. Nothing you paste is sent to our servers, logged, or stored — you can load the page, disconnect from the internet, and it still works. That matters because headers contain email addresses, IP addresses and internal hostnames.
Why does DMARC fail when SPF and DKIM both pass?
DMARC needs SPF or DKIM to pass for a domain that matches the visible From domain. If SPF passed for your email provider's bounce domain and DKIM passed for its signing domain (for example gappssmtp.com or amazonses.com), both pass but neither aligns, so DMARC fails. Fix it by enabling DKIM with your own domain in your mail provider.
Why did my email take so long to arrive?
Compare the timestamps on each Received header. A long gap before the first hop usually means the sending tool queued or scheduled the message. A long gap later is usually greylisting (the receiver deferred the first attempt with a 4xx code), sender throttling, or a slow security scanner. The route view highlights the slowest hop.
What do SCL, BCL and CAT mean in Outlook headers?
They are Microsoft 365 spam verdicts. SCL (spam confidence level) of -1 means filtering was skipped, 0–1 means not spam, 5–6 spam, and higher values high-confidence spam. BCL (bulk complaint level, 0–9) rates how complaint-prone bulk mail is; the default bulk threshold is 7. CAT is the policy that applied, such as NONE, BULK, SPM, PHSH or SPOOF.
Can email headers be faked?
Partly. A sender can write any Received headers they like below the first server they hand the message to, so only trust hops added by servers you control or by the recipient's provider — the top of the chain. Authentication-Results added by the receiving server, and DKIM signatures, cannot be forged without the private key.
Related tools
Try Clement free for 14 days
Clement sends cold email straight from your own Gmail and SMTP inboxes, so recipients see the SPF, DKIM and DMARC you set up on your domain, with no shared sending pool in between.
Start free trial