Email header analyzer
Paste the raw header of an email to see what the receiving server concluded, why DMARC passed or failed, and the route the message took.
Read a header from the top for the verdict and from the bottom for the route. The receiving server adds its Authentication-Results line above the others (RFC 8601, section 4), so the top one holds its own SPF, DKIM and DMARC results, and a lower one may have been forged on the way (section 7.1). Each server adds a Received line at the top as it takes the message (RFC 5321, section 4.4), so the bottom one is where the message started.
Last verified . The sources named on this page were read that day.
Email header analyzer, the tool
The header is read on this page. Nothing you paste is sent anywhere or stored.
Load a sample
Sample. Gmail format. SPF and DKIM pass for the sending service's domain, and DMARC fails for the From domain. Made up, with example domains and documentation IP addresses.
Analyzed 19 header fields. mx.google.com checked this message: SPF pass, DKIM pass, DMARC fail for example.com. DMARC failed on alignment: DKIM passed for esp.example.net and SPF passed for bounces.esp.example.net, but neither domain is example.com or in its organizational domain.
Sample. Results for the sample “DMARC fails on alignment”.
What the receiver concluded
Read from the topmost Authentication-Results, written by mx.google.com.
- From
- Example Co
<hello@example.com> - To
jordan@example.org- Subject
- A note on your Q4 plan
- Date
- Oct 17, 2026, 09:41:05 UTC
- Return-Path
bounce-41c2d7@bounces.esp.example.net- Message-ID domain
esp.example.net
- Problem: mx.google.com checked this message: SPF pass, DKIM pass, DMARC fail for example.com.
- Problem: DMARC failed on alignment: DKIM passed for esp.example.net and SPF passed for bounces.esp.example.net, but neither domain is example.com or in its organizational domain.
- Note: 4 Received lines, 7 min 25 s from the first stamp to the last. Every hop between servers that names its protocol shows TLS.
Authentication-Results: mx.google.com;dkim=pass header.i=@esp.example.net header.s=s1 header.b=UtkSQpLk;spf=pass (google.com: domain of bounce-41c2d7@bounces.esp.example.net designates 198.51.100.91 as permitted sender) smtp.mailfrom=bounce-41c2d7@bounces.esp.example.net;dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=example.comA header cannot show whether the message reached the inbox. It records what the receiving server checked and concluded on the way in.
Worth a second look
- Problem: One hop took 7 min 24 s, arriving at o12.mta.esp.example.net. We mark any hop over 5 minutes. Source: RFC 5321, section 4.4.
- Pass: One-click unsubscribe is in place: an HTTPS address, List-Unsubscribe-Post, and both fields signed by esp.example.net. Source: RFC 8058, section 3.1, Google's sender guidelines, Yahoo's sender best practices.
Route, oldest hop first
4 Received lines, 7 min 25 s end to end.
- Oct 17, 2026, 09:41:06 UTC1 s after the Date line
api.esp.example.net192.0.2.4 toqueue-07.esp.example.net - 09:48:30 UTC+7 min 24 s
queue-07.esp.example.net192.0.2.17 too12.mta.esp.example.netOver 5 minutes since the hop before.
- 09:48:31 UTC+1 s
o12.mta.esp.example.net198.51.100.91 tomx.google.com - 09:48:31 UTC+0 s
Inside
2001:db8:7300:5a8c:b0:12a:3456:789b
Times are the servers’ own stamps, shown in UTC. We mark a hop that took more than 5 minutes; that line is our choice, and no standard sets one. TLS is read from the protocol name (RFC 3848) or a TLS version in the line.
Authentication and alignment
Compared with the From domain, example.com.
DMARC failed on alignment: DKIM passed for esp.example.net and SPF passed for bounces.esp.example.net, but neither domain is example.com or in its organizational domain.
| Check | Domain | Result | Alignment with From |
|---|---|---|---|
| DMARCheader.from | example.com | failPolicy p=none | The From domain itself |
| SPFsmtp.mailfrom | bounces.esp.example.net | pass | Not aligned |
| DKIMheader.d, s=s1 | esp.example.net | pass | Not aligned |
DKIM signatures in the header
d=esp.example.nets=s1- Algorithm
rsa-sha256. Signs 9 header fields:from, subject, to, list-unsubscribe, list-unsubscribe-post, date, message-id, mime-version, content-type.
Relaxed alignment compares organizational domains. This page estimates example.com’s as example.com from the name alone; a receiver looks it up in DNS (RFC 9989, section 4.10).
Spam filter verdicts
None found.
No spam filter headers this page reads: Microsoft 365 (X-Forefront-Antispam-Report, X-Microsoft-Antispam), Exchange (X-MS-Exchange-Organization-SCL) or SpamAssassin (X-Spam-Status).
List and bulk headers
- List-Unsubscribe
https://esp.example.net/unsub/41c2d7mailto:unsub-41c2d7@bounces.esp.example.net- List-Unsubscribe-Post
List-Unsubscribe=One-Click- One-click unsubscribe
- In place. HTTPS address: yes. Post value: yes. Both fields signed by DKIM: yes (esp.example.net). Source: RFC 8058, section 3.1, Google's sender guidelines, Yahoo's sender best practices.
Every header, as pasted
19 fields, top to bottom.
19 fields
| Field | Value |
|---|---|
Delivered-To | jordan@example.org |
Received | by 2001:db8:7300:5a8c:b0:12a:3456:789b with SMTP id k12csp1239981dyb; Sat, 17 Oct 2026 02:48:31 -0700 (PDT) |
X-Received | by 2001:db8:a17:906:b0:3f1:22c4:9a10 with SMTP id hz8mr2297341ejc.4.1792230511702; Sat, 17 Oct 2026 02:48:31 -0700 (PDT) |
Return-Path | <bounce-41c2d7@bounces.esp.example.net> |
Received | from o12.mta.esp.example.net (o12.mta.esp.example.net. [198.51.100.91]) by mx.google.com with ESMTPS id 5b1f17b1804b1-4a2c9e1f3b7sor2248101f9.31.2026.10.17.02.48.31 for <jordan@example.org> (Google Transport Security); Sat, 17 Oct 2026 02:48:31 -0700 (PDT) |
Received-SPF | pass (google.com: domain of bounce-41c2d7@bounces.esp.example.net designates 198.51.100.91 as permitted sender) client-ip=198.51.100.91; |
Authentication-Results | mx.google.com; dkim=pass header.i=@esp.example.net header.s=s1 header.b=UtkSQpLk; spf=pass (google.com: domain of bounce-41c2d7@bounces.esp.example.net designates 198.51.100.91 as permitted sender) smtp.mailfrom=bounce-41c2d7@bounces.esp.example.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=example.com |
DKIM-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=esp.example.net; s=s1; t=1792230065; h=from:subject:to:list-unsubscribe:list-unsubscribe-post: date:message-id:mime-version:content-type; bh=FqVIreIvb2Y6v8y+eVmlNJshWNCRjq6oKlp38mvITzA=; b=UtkSQpLkV/+QE5XrJTMkwYp99XX+N9QHDm1bWJYCdXqtY0niijjJrw8Id642boWud7I4FdKCUr9QNMMfK+1fGeGiarkrhZHkc6XmzinQY4qJ+F6ykQvdUNGozEbDd6T3 |
Received | from queue-07.esp.example.net (queue-07.esp.example.net [192.0.2.17]) by o12.mta.esp.example.net (Postfix) with ESMTPS id 4ZQr7Tq1Wxz5 for <jordan@example.org>; Sat, 17 Oct 2026 09:48:30 +0000 (UTC) |
Received | from api.esp.example.net (api.esp.example.net [192.0.2.4]) by queue-07.esp.example.net (Postfix) with ESMTPS id 4ZQr0Hc8Lnz2 for <jordan@example.org>; Sat, 17 Oct 2026 09:41:06 +0000 (UTC) |
From | Example Co <hello@example.com> |
To | jordan@example.org |
Subject | A note on your Q4 plan |
Date | Sat, 17 Oct 2026 09:41:05 +0000 |
Message-ID | <41c2d7.20261017094105@esp.example.net> |
List-Unsubscribe | <https://esp.example.net/unsub/41c2d7>, <mailto:unsub-41c2d7@bounces.esp.example.net> |
List-Unsubscribe-Post | List-Unsubscribe=One-Click |
MIME-Version | 1.0 |
Content-Type | multipart/alternative; boundary="b1_41c2d7" |
How to read Authentication-Results, line by line
Authentication-Results: mx.google.com;The server that ran the checks. Your own receiver’s line is the top one.
dkim=pass header.i=@esp.example.net header.s=s1 header.b=UtkSQpLk;DKIM passed for esp.example.net, with the key named by header.s (RFC 8601, section 2.7.1).
spf=pass (google.com: domain of bounce-41c2d7@bounces.esp.example.net designates 198.51.100.91 as permitted sender) smtp.mailfrom=bounce-41c2d7@bounces.esp.example.net;SPF passed for bounces.esp.example.net, the envelope sender, which the reader never sees (section 2.7.2).
dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=example.comDMARC failed for example.com, the From domain, because neither pass above is for it. p= is the policy that domain publishes.
In Microsoft 365 and forwarded mail
compauth=pass reason=100Microsoft 365’s own verdict, with a reason code. A message can be allowed when it fails (Microsoft).
arc=passResults sealed by servers on the way, such as a mailing list. ARC is experimental (RFC 8617).
Why DMARC fails when SPF and DKIM pass
DMARC asks whether SPF or DKIM passed for the From domain. A sending service often uses its own bounce domain and its own d= until you set up yours there. One aligned pass is enough, and Google and Yahoo require one from bulk senders. Relaxed alignment, the default, accepts the same organizational domain; strict needs the same name (RFC 9989, section 4.4).
| From domain, and the domain that passed | Relaxed | Strict |
|---|---|---|
example.com and example.comDKIM signed with your own domain | Aligned | Aligned |
example.com and mail.example.comA subdomain you set up at the sending service | Aligned | Not aligned |
example.com and bounces.esp.example.netThe sending service's own bounce domain | Not aligned | Not aligned |
example.co.uk and news.example.co.ukUnder a two-label public suffix | Aligned | Not aligned |
Worked out by the analyzer, which guesses the organizational domain from the name; a receiver looks it up in DNS (RFC 9989, section 4.10).
What SCL and BCL mean
- SCL, spam confidence level
- -1 to 9, as
SCLin X-Forefront-Antispam-Report. Microsoft says that in Microsoft 365 the SCL no longer decides the verdict;SFVandCATdo (Microsoft’s SCL page). - SFV and CAT
SFV:NSPMmeans clean,SFV:SPMspam, and values startingSKthat a list, rule or release decided.CATnames the policy that acted, such asBULKorPHSH.- BCL, bulk complaint level
- 0 to 9, in X-Microsoft-Antispam. At or above the threshold, mail is treated as bulk: 7 by default, 6 in the Standard preset and 5 in Strict (Microsoft’s bulk email page).
| BCL | What Microsoft says it means |
|---|---|
| 0 | The message is not from a bulk sender. |
| 1 to 3 | From a bulk sender that generates few complaints. |
| 4 to 7 | From a bulk sender that generates a mixed number of complaints. |
| 8 and 9 | From a bulk sender that generates a high number of complaints. |
Related tools
- Email domain checkerCheck a domain's SPF, DKIM, DMARC, MX, BIMI, MTA-STS and blocklist status, with the record to publish for each problem.
- DMARC checkerLook up a domain's DMARC record, see which policy applies to its mail, and build the next record to publish.
- SPF record checkerCheck a domain's SPF record and count its DNS lookups through every include against the limit of 10.