Debugging

Email Header Analyzer

Reads the raw headers of a received email and shows SPF, DKIM and DMARC results, alignment and the delivery path.

Runs in your browser
Free to run

Open the tool

You enter: Raw headers copied from a received email.
You get: A verdict, SPF, DKIM and DMARC cards with alignment, the sender identifiers and every hop.
A good result: All three pass and both SPF and DKIM are aligned with the From domain.

On this page

What it is for
What you enter
How it works
Reading the results
Example
Limits and gotchas

#What it is for

DNS can look right while real mail still fails. The headers show what the receiving server actually decided. Use it when a recipient reports spam placement or a bounce mentions authentication.

#What you enter

Paste the headers (in Gmail: Show original; in Outlook: View message source). The body can stay attached; parsing stops at the first blank line. Load sample shows the format.

#How it works

Everything happens in your browser; nothing is uploaded. Folded lines are joined, the first Authentication-Results header is read for spf=, dkim= and dmarc=, and alignment is worked out:

SPF aligned: the Return-Path domain matches the From domain (or one is a subdomain of the other).
DKIM aligned: the signing domain header.d matches the From domain the same way.

#Reading the results

Pass: all three checks pass and are aligned.
Fail: at least one is fail, permerror or temperror.
Warning: a result is missing or something is not aligned.

Below are the envelope fields (From, Return-Path, Reply-To, Message-ID, List-Unsubscribe), the delivery path oldest hop first, and spam filter headers such as X-Spam-Status when present.

#Example

A healthy result

Authentication-Results: mx.google.com; spf=pass smtp.mailfrom=mail.example.com; dkim=pass header.d=example.com; dmarc=pass header.from=example.com

With From: hello@example.com both SPF (via the subdomain) and DKIM are aligned and the verdict is a pass.

#Limits and gotchas

Only the first Authentication-Results header is used. Forwarded mail may carry several; the top one is normally the final receiver's.
A missing Return-Path makes SPF look unaligned.