Email Header Analyzer

How do I read email headers?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

Read the Received lines from the bottom up to follow the message from sender to inbox, and check Authentication-Results for the receiving server's SPF, DKIM and DMARC verdicts. This analyzer does both in your browser: it lists every hop with the delay between them and pulls out each authentication result.

Each server that handles a message adds a Received header at the top, so the oldest hop is at the bottom. The analyzer lists them in that order and calculates the delay from the timestamp each server added.

Authentication-Results records what the receiving server concluded, not what the sender claims. That is why it is the header to trust when you are deciding whether a message is genuine.

How do I find and analyze email headers?

Gmail: open the message, choose More (⋮) and Show original. Outlook: open the message, then File, Properties, Internet headers. Apple Mail: View, Message, All Headers.
Copy the complete header block, from the first Received line down to the end of the headers, and paste it here.
Check the authentication results first, then look for unusually long delays between hops.

How to read the results

Hops: Each Received header: the server that sent it on (from), the server that accepted it (by), and the time. Delay is the gap to the previous hop, in seconds.
Authentication results: Each method (spf, dkim, dmarc and others such as arc) with its verdict: pass, fail, softfail, neutral, none, temperror or permerror.
From, To, Subject, Date, Message-ID: The main identifying headers, shown as received. The From address is easy to forge; the authentication results tell you whether to trust it.

What common header findings mean

dmarc=fail on a message from a well-known brand

Treat the message as spoofed. Don't click links or reply; report it as phishing.

Authentication-Results: mx.example.net; spf=softfail smtp.mailfrom=bank.example; dkim=none; dmarc=fail header.from=bank.example

spf=pass but dmarc=fail on your own mail

SPF passed for the provider's bounce domain, not yours, so it doesn't align with the From domain. Set up DKIM signing with your own domain at that provider.

Long delay at one hop

Usually greylisting, a queue on a busy server, or slow content scanning at that hop. Check that server's logs for the time shown.

Examples and command-line equivalents

Sample Authentication-Results header

Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=2026a;
       spf=pass [email protected];
       dmarc=pass (p=REJECT) header.from=example.com

Print the headers of a saved message on Linux

Headers end at the first blank line of an .eml file.

sed '/^$/q' message.eml

Frequently asked questions

How do I spot a spoofed email from its headers?

Check the Authentication-Results line: a fail or none for SPF, DKIM and DMARC on a message claiming to be from a well-known domain is a strong warning sign. Also compare the From domain with the Return-Path and the DKIM d= domain.

Why are the hop delays sometimes negative?

Each server stamps its own clock. If one server's clock is wrong, the calculated delay can be negative or exaggerated. Large positive delays usually point to greylisting, queueing or content filtering.

Are the headers I paste sent anywhere?

No. The headers are parsed in your browser. They can still contain internal host names and IP addresses, so be careful where else you share them.