How this analysis works
The headers are parsed in your browser according to RFC 5322. Received headers are read from the bottom up to reconstruct the path, and their timestamps give the delay of each hop.
Authentication results come from the Authentication-Results header (RFC 8601) added by the receiving system. We compare the authenticated domains with the From address to estimate DMARC alignment, inspect DKIM-Signature headers for weak settings and surface spam-filter verdicts that some providers expose.
Limitations
- Headers can be forged by the sender. Only the Authentication-Results and Received headers added by your own mail provider — usually the topmost ones — are trustworthy.
- We read the verdicts recorded in the headers; we do not re-verify signatures or query DNS.
- Alignment uses the Public Suffix List to find organizational domains; receivers following RFC 9989 may reach a different result in rare setups.
Frequently asked questions
How do I get the full headers of a message?
Gmail: open the message, use the ⋮ menu and choose “Show original”. Outlook on the web: ⋯ menu → “View” → “View message details”. Outlook for Windows: open the message, File → Properties, “Internet headers”. Apple Mail: View → Message → All Headers. Thunderbird: View → Message Source.
Is the content I paste sent anywhere?
No. Parsing happens in JavaScript on this page; nothing is uploaded, stored or logged. You can disconnect from the network and the analyzer keeps working.
Which Authentication-Results header should I trust?
The one added by your own provider, normally the first one from the top, with an authserv-id such as mx.google.com or your company’s mail gateway. Lower ones may come from intermediate systems or the sender.
Why is the delivery path shown in reverse?
Every server adds its Received header at the top, so the oldest hop is at the bottom. We reverse the list to show the path in the order the message traveled.
What does dmarc=fail mean if SPF and DKIM passed?
The passing domains were not aligned with the From address. This is typical when an email service signs with its own domain. Configure the service to sign with your domain (custom DKIM) or use a custom return-path domain.