Email header analyzer

How to copy the headers

• Gmail: open the message, click the three-dot menu next to Reply and choose “Show original”. Copy everything, or use “Copy to clipboard”.
• Outlook on the web and the new Outlook: open the message, click the three-dot menu, then View and “View message source” (or “View message details”).
• Classic Outlook for Windows: open the message in its own window, then File, Properties, and copy the “Internet headers” box.
• Apple Mail: select the message, then View, Message, and “All Headers” or “Raw Source”.
• Thunderbird: select the message, then View and “Message Source” (Ctrl+U, or Cmd+U on a Mac).

Pasting the whole message is fine: only the part before the first empty line, the header block, is read.

Reading the results

Delivery path. Every server that accepts a message adds a Received line at the top, so in the raw headers the first server is at the bottom. The table puts them in order, first server first, with the time each one received the message and how long it took since the previous one. A wait of a few seconds is normal; minutes usually mean a queue, greylisting or a spam scan, and a negative delay only means two servers’ clocks disagree.

SPF checks that the server that sent the message is allowed to send for the envelope sender’s domain (the Return-Path). DKIM checks a signature added by the sending domain, which breaks if the message was changed on the way. DMARC passes when SPF or DKIM passes for the same domain as the visible From address, and the domain’s policy says what receivers should do with mail that fails: nothing, spam folder, or reject.

These results come from the Authentication-Results header that the receiving server adds. Headers copied from your Sent folder don’t have it, and some servers don’t add it at all.