Paste headers to see the analysis.
Click Analyze headers after you paste, or load the example to see a result.
How to get the full headers
The analyzer needs the raw, original headers, not the short From and Subject line the inbox shows by default. Every mail app tucks the full version behind a menu.
- Gmail
- Open the message, click the three-dot menu at the top right, and choose "Show original". Copy the block it opens in a new tab.
- Outlook on the web
- Open the message, click the three-dot menu, choose View, then "View message source".
- Apple Mail
- Open the message and choose View, then Message, then All Headers to reveal the raw headers.
Menu wording shifts between versions, so look for the option that reveals the source or original message. Paste the whole thing, including the top Received lines.
How to read the delivery path
Every server that touches a message stamps a Received line at the top of the headers. Because each new hop lands above the previous one, the list reads newest-first, so the bottom Received line is the earliest hop, which is usually the sending system. The analyzer reverses them so you read origin to inbox, top to bottom.
The delay column is the gap between each hop and the one before it. Most hops move in under a second or two. A large gap between two hops usually means the message waited in a queue at a relay, or hit greylisting, where a receiving server defers the first attempt and accepts a retry a few minutes later.
Each timestamp comes from that server's own clock, so a hop can show a negative gap when two clocks disagree. The analyzer clamps those to zero and marks the hop as clock skew.
What SPF, DKIM, and DMARC results mean
SPF answers whether the server that sent the message was allowed to send for the domain in the envelope sender. A pass means the sending IP is on that domain's published list.
DKIM answers whether the message carried an intact cryptographic signature tied to a domain, so the body and signed headers weren't altered in transit. A pass means the signature checked out for the domain that signed it.
DMARC answers whether SPF or DKIM lines up with the visible From domain. A pass means at least one of them matched the address the reader actually sees, which is what makes spoofing harder.
What the unsubscribe headers are
List-Unsubscribe gives inbox providers a link or mailto address so a reader can opt out without hunting for a footer. One-click support lets the reader unsubscribe without opening a landing page.
Questions, answered.
No. The analyzer reads the headers in your browser and doesn't upload them anywhere, so you can paste headers from a private message.