Email Header Analyzer
Paste raw email headers to trace the delivery path and read the SPF, DKIM, and DMARC results.
What are email headers?
Email headers are the hidden metadata attached to every message - think of them as the shipping labels and tracking history on a package. They record the routing chain the message took, the sender identity (From, Return-Path, Reply-To), the authentication results, the spam-filter decisions, and a timestamp at every hop.
Paste a message's raw headers above and this tool parses the Received hops, the sender fields, and the Authentication-Results line that shows whether SPF, DKIM, and DMARC passed. It's the fastest way to diagnose why a specific message landed in spam. Everything runs in your browser - nothing is uploaded.
How to find your email headers
Every mail client hides the raw headers somewhere. Here's where to look, then copy everything and paste it above.
Understanding Authentication-Results
This is the single most important header for diagnosing deliverability. It records how the three checks came out.
SPF
Was the sending IP authorized for the Return-Path domain? Reads pass, fail, softfail or neutral. Fix by adding the IP or the provider's include.
DKIM
Was the message signed by the claimed domain and left unmodified? Reads pass, fail or none. Fix by checking the d= and s= tags and the published key.
DMARC
Ties the two together with alignment - needs one to pass and align. Reads pass, fail or none, and the policy applied.
Reading the Received chain
Received headers are listed in reverse order: the bottom-most header is the first server that handled the message (the origin), and the top is the last. Read from the bottom up. from = the server that sent to this hop, by = the server that received, with = the protocol.
Received: from mail-sender.example.com (198.51.100.42)
by mx.recipient.com with ESMTPS; Tue, 08 Apr 2025 14:23:17 -0400Common header fields
Beyond authentication, these are the fields worth knowing when you're tracing a message.
| Field | What it tells you |
|---|---|
| From vs Return-Path | From is the visible, unverified sender. Return-Path is the envelope/bounce address - and it's what SPF actually checks. |
| Reply-To | Optional address replies are routed to. Not used for authentication. |
| Message-ID | A globally unique id for the message, useful for tracing it across logs and support tickets. |
| X-Mailer / User-Agent | The software that sent it - Outlook, Apple Mail, Mailchimp, or a custom script. |
| X-Spam-Status | The spam filter's verdict, total score, threshold, and each test that contributed. |
| X-Originating-IP | Added by some webmail (notably Outlook.com); the composer's actual IP rather than the mail server's. |
Troubleshooting with headers
Authentication failures are the most common cause of spam placement - check the Authentication-Results line first. A high spam score is next: SpamAssassin scores above 5.0 typically mean spam classification, and the individual tests in X-Spam-Status tell you which triggers fired (missing auth, HTML-only content, URL shorteners, excessive capitalization).
For delays, a 5 to 30 minute gap on the first hop is usually greylisting; a delay at one intermediate server is queue congestion; unexpected routing points to a misconfigured MX. And while a From header can be freely faked (that's spoofing), the Received headers and their authentication results are added by the receiving servers and can't be forged by the sender - which is exactly why they're trustworthy.
Frequently asked questions
How do I get an email's raw headers?
In Gmail, open the message, click the three-dot menu, and choose Show original. In Outlook, open the message and choose File > Properties (Internet headers). In Apple Mail, use View > Message > All Headers. Copy everything and paste it above.
What does Authentication-Results show?
It's the line receiving servers add recording whether SPF, DKIM, and DMARC passed for the message, along with the domains they authenticated. It's the quickest way to see which check failed.
Can email headers be faked?
The From header can - that's exactly what spoofing is. But the Received headers and authentication results are added by intermediate and receiving servers, not the sender, so they can't be forged. Read those for the truth.
How do I find the sender's real IP?
Read the bottom-most Received header (the origin server), or look for an X-Originating-IP header, which some webmail clients add with the composer's actual IP.
What is the difference between From and Return-Path?
From is the visible sender address, which is unverified. Return-Path is the envelope sender used for bounces - and it's the domain SPF checks, which is why a message can pass SPF while its visible From says something else.
Is my pasted email private?
Yes. The header analyzer runs entirely in your browser - nothing is uploaded to a server.
Next steps
Stop configuring DNS by hand
Cladiant provisions real Google Workspace, Microsoft 365, and Azure Entra mailboxes with SPF, DKIM, and DMARC written and verified on every domain before a single message sends. No DNS headaches, no authentication gaps, one invoice.