Prontuno
Pricing
AI

Appearance

Log in Request access
Tools

ToolsMessages

Free email header analyzer

Paste the raw headers from a received message to check SPF, DKIM, and DMARC results and trace the sending path.

The parser reads only the header section. Message bodies and attachments are ignored.

We do not log or save the email headers or message source you analyze.

Background

What are email headers?

Email headers are the fields at the top of every message that record who sent it, which servers handled it, and how it was authenticated. Each server that handles the message adds a Received header, and the receiving server adds Authentication-Results with its SPF, DKIM, and DMARC verdicts.

How to read the result

Received headers are added from the top, so read them from the bottom up to follow the message from the first server to the last. Compare the timestamps between hops to find where a message was delayed.

Authentication-Results shows how the receiving server evaluated SPF, DKIM, and DMARC. Compare the domains, selectors, and IP addresses with the services you expect to send the message.

Coverage

What this tool checks

  • SPF, DKIM, and DMARC results from Authentication-Results and ARC headers
  • The likely sending IP, its network, and its reverse DNS
  • Each server in the Received chain, with timestamps and TLS use
  • Message details such as From, Date, and Message-ID
  • Identity mismatches, malformed headers, and other issues to review

Step by step

How to copy an email’s raw headers

  1. In Gmail, open the message, open the More menu, select Show original, then select Copy to clipboard.

  2. In Outlook on the web, open the message, open More actions, then select View → View message source.

  3. In Apple Mail, select the message, then choose View → Message → Raw Source.

  4. Paste the text into the form above and select Analyze Headers.

Reference

Headers to check first

Header What it tells you
Received One entry per server hop, with the newest at the top.
Authentication-Results The SPF, DKIM, and DMARC verdicts from the receiving server.
DKIM-Signature The signing domain (d=) and selector (s=).
Return-Path The envelope sender, whose domain SPF checks.
ARC-Authentication-Results Results preserved by forwarders and mailing lists.
Message-ID A unique identifier you can search for in mail server logs.

Troubleshooting

Common problems and how to fix them

SPF failed
Check whether the sending IP is authorized in the SPF record of the envelope sender’s domain, and add the service if it is missing.
DKIM failed
Check the selector and public key, the signing domain, and whether the message was changed after signing, for example by a mailing list.
DMARC failed
Confirm that SPF or DKIM passed for a domain that aligns with the From address.
Long delivery delay
Compare the Received timestamps to find the hop where the message waited, then check that server’s queue or logs.

Example

Received: from mail.example.com (mail.example.com [192.0.2.10])
        by mx.example.net with ESMTPS; Tue, 15 Sep 2026 10:12:03 +0000
Authentication-Results: mx.example.net;
        spf=pass smtp.mailfrom=example.com;
        dkim=pass header.d=example.com header.s=pm1;
        dmarc=pass header.from=example.com
From: Example <hello@example.com>
Message-ID: <abc123@example.com>
Paste the full header block. The analyzer ignores the message body and attachments, and does not log or save what you paste.

FAQ

Questions about email headers

Do email headers contain private information?
They can include email addresses, internal hostnames, and IP addresses. Remove anything you do not want to share before sending headers to someone else.
Why are Received headers read from the bottom?
Each server adds its Received header above the existing ones, so the first server is at the bottom.
Can headers prove a message is legitimate?
They are strong evidence, but not proof on their own. Only trust Authentication-Results added by your own mail provider, because senders can forge headers added before the message reached it.

Keep checking

Related tools

  • Free SPF checker

    Validate a domain’s SPF policy, inspect mechanisms, and count DNS lookups.

  • Free DKIM checker

    Validate a DKIM public key by domain and selector, including algorithm, size, and revocation status.

  • Free DMARC checker

    Review a domain’s DMARC policy, alignment, reporting addresses, and enforcement.

Specifications
RFC 5322: Internet Message Format (opens in a new tab)
RFC 8601: Message Header Field for Indicating Message Authentication Status (opens in a new tab)
RFC 8617: The Authenticated Received Chain (ARC) Protocol (opens in a new tab)