Email header analyzer
Paste the full headers of a message to see the servers it passed through, how long each step took, and how each receiver judged it.
Try a sample Mailing list, 5 h at one hopMicrosoft 365 via ProofpointExim with Rspamd and SpamAssassin
The link does not contain readable headers: it may have been cut when copied.
How the analysis works
Copy a message's full headers: in most mail programs, "Show original", "View source" or "View message details".
Paste them here. The body, after the first empty line, is removed in your browser before sending, and the headers are not stored.
The Received lines are read from the bottom up: the route, each hop's delay and whether it used TLS.
Authentication-Results, ARC and the filters' fields are explained: who checked SPF, DKIM and DMARC, and what the spam filters decided.
What is shown
- Route
Each server the message passed, in order, with the address it came from, TLS, the time and the delay; the slowest step is marked and clock errors are pointed out.
- Authentication
SPF, DKIM, DMARC and ARC results from Authentication-Results and Received-SPF, with which server evaluated them.
- Anti-spam verdicts
Verdicts of SpamAssassin, Rspamd and Microsoft 365 filters, when their headers are present.
The headers are analyzed in memory and discarded when the page is sent. They are not written to a database or to our logs.
Background: How to read email headers: route, delays, SPF, DKIM