Mail / Runs in your browser
Email Header Analyzer
A free email header analyzer for messages from Gmail, Outlook, Microsoft 365, or any other mail service. Paste the full header to see the route the message took from end to end. The report leads with a verdict, names the hop that held the message or the check that failed, and lists every server, delay, and authentication result behind it.
Get the header
How to copy a message header
Gmail
Open the message, choose More (the three dots) next to Reply, then Show original. Use Copy to clipboard and paste the whole page here.
Outlook on the web and the new Outlook
Open the message, choose More actions (the three dots), then View, then View message details. Select all of the text and copy it.
Classic Outlook for Windows
Open the message in its own window, choose File, then Properties. Copy everything in the Internet headers box.
Apple Mail
Select the message, then choose View, Message, Raw Source. Copy the text from the top down to the first blank line, or all of it.
A saved message
Use Open .eml file above. The file is read in your browser and only its header is used.
Method
What the report checks
Every hop, in order
Each server that handles a message adds a Received header above the ones before it. The report turns them around, so hop 1 is the first server, and shows who passed the message to whom, the connecting address, the protocol, and whether the hop records TLS.
Where the time went
Each hop's delay is the time since the hop before it, and the first hop's is the time since the Date header the sender's mail client wrote. A hop that took 5 min or more is a warning, and one that took 1 h or more is a delivery problem. Servers whose clocks disagree are noted instead of shown as a negative delay.
Authentication
SPF, DKIM, DMARC, ARC, and Microsoft's composite authentication, read from the Authentication-Results header the receiving server added at the top. A failed SPF or DKIM check counts as a warning when DMARC still passed, which is what forwarding usually looks like.
Spam verdicts
Exchange Online's X-Forefront-Antispam-Report and X-Microsoft-Antispam fields and SpamAssassin's X-Spam-Status. Codes whose meaning Microsoft documents are explained; any other code is shown as written.
The message itself
A missing From, Date, or Message-ID field, replies that go to a different domain than the sender, and bounce messages.
Questions
Reading an email header
How do I read an email header?
Start at the bottom. Each server that handles a message adds a Received line on top of the ones already there, so the lowest Received line is the first server and the top one is the last. Authentication-Results near the top holds the SPF, DKIM, and DMARC checks the receiving server ran. Paste the header above and the report puts the hops in order and explains each result.
Why was my email delayed?
Compare the time stamp on each Received line with the one below it. The hop with the big gap is where the message waited, usually in a server's queue after the next server refused it for a while. A gap before the first hop means the sender's mail client held the message or its clock is wrong. The report measures every gap and marks the one that took 5 min or more.
What do SPF, DKIM, and DMARC results in a header mean?
SPF checks that the sending server is allowed to send for the envelope sender's domain. DKIM checks a signature the sending domain added to the message. DMARC passes when SPF or DKIM passes for a domain that matches the From address, and the domain's DMARC policy tells receivers what to do when it fails. When that policy is quarantine or reject, a DMARC failure sends the message to Junk or gets it refused.
Why does the report say there are no delivery issues when the message went to Junk?
A header records what servers did, not every rule a mailbox applies. A user's own junk settings or an inbox rule can move a message without adding anything to the header. When a spam filter did mark it, its verdict shows under Spam filter verdicts.
Which header do I need: the sender's copy or the recipient's?
The recipient's. The copy in the sender's Sent folder has no Received headers from the receiving side and no authentication results, so there is little to trace.
Is my header uploaded anywhere?
No. The analysis runs in this page, in your browser. The header is not sent to this site, stored, or shared, and the page works with the network turned off once it has loaded.
What can a header not tell me?
Why a server refused a message that never arrived: that reason is in the bounce or in the sending server's logs. A header also cannot prove a hop's clock was right, so a delay next to a clock difference is an estimate. To check a domain's published SPF, DMARC, and MX records, use Domain Recon.