Free Tool

Email Header Analyzer

Paste the message headers of any email to see whether it passed SPF, DKIM and DMARC, the route it took, where it was delayed, and any signs of spoofing.

Headers are processed in your browser. Nothing is uploaded to our servers.

Email headers

Open .eml file Where do I find headers?

Email Header Analysis

MailIntela product of CloudNow Solutions

Findings

Message summary

Domain alignment

DMARC passes when SPF or DKIM passes for a domain that matches the visible From domain.

Delivery path

Received hops

#	From	By	Protocol	Time (UTC)	Delay

Spam filter verdicts

Header	Value	Meaning

All headers

Header	Value

Results are read from the headers as written by the receiving mail servers. Alignment uses a simplified check of the organizational domain. Headers were processed locally in the browser and were not uploaded. Generated with MailIntel Email Header Analyzer.

Guide

How to read email headers

Every email carries hidden headers that record where it came from, which servers handled it, and whether it passed authentication. Here is how to find them and what the results mean.

Where do I find the headers?

Outlook (classic desktop): open the message in its own window, then File → Properties. Copy the text under "Internet headers".
New Outlook and Outlook on the web: open the message, select the … menu → View → View message details.
Gmail: open the message, select the ⋮ menu → Show original, then copy everything above the message body.
Apple Mail: View → Message → All Headers, or save the message as an .eml file.
Yahoo Mail: open the message, select More → View raw message.

Copy the headers from the recipient's inbox. Copies from the sender's Sent folder don't include the receiving server's authentication results.

What do SPF, DKIM and DMARC results mean?

SPF: checks that the sending server is allowed to send for the envelope sender domain (the Return-Path).
DKIM: checks a cryptographic signature added by the sender, proving the message wasn't altered and showing which domain signed it.
DMARC: passes only when SPF or DKIM passes for a domain that matches the visible From address. This is what stops spoofing of your domain.
Alignment: a newsletter service can pass SPF and DKIM for its own domain and still fail DMARC for yours. Custom DKIM for your domain fixes this. See why third-party email fails DMARC.

Signs an email may be spoofed or phishing

DMARC fails, or SPF and DKIM both fail, for the domain in the From address.
The display name shows one email address while the real From address is different.
Replies go to a different domain than the one the message claims to be from.
The message was sent from a server or country your organization doesn't use.

None of these prove fraud on their own, but together they are strong warning signs.

Common questions

Is it safe to paste headers here?: Yes. The analyzer runs entirely in your browser. Headers and .eml files are never uploaded to our servers.
Why does it say no authentication results were found?: The headers probably came from the sender's copy of the message. Copy them from the recipient's inbox instead.
Why was my email delayed?: The delivery path shows the time between each server. Large gaps usually mean spam filtering, a busy server, or the sending server retrying after a temporary error.
How is this different from Microsoft's Message Header Analyzer?: Microsoft's Message Header Analyzer is a good choice inside Outlook. This tool works with headers from any email provider, and adds plain-English findings, DMARC alignment checks and a PDF report.
My own emails fail DKIM. How do I fix it?: If you use Microsoft 365, DKIM for your custom domain must be turned on first. Follow our guide to enabling DKIM in Microsoft 365.
Should I open .eml files from unknown senders?: Opening one here is safe. The analyzer only reads the headers as text, and never opens links or attachments.

Explore more free tools → Analyze your DMARC reports → Microsoft 365 guides → Monitor your domains automatically →