Email Header Analyzer

Paste raw email headers to trace every Received hop with delays, read SPF, DKIM, DMARC and ARC results, decode Microsoft 365 spam headers (SCL, BCL, SFV, CAT) and spot spoofing signs. Runs 100% in your browser.

Parsing happens entirely in this page. The headers you paste are not uploaded or sent anywhere.

Paste the full header block and click Analyze headers, or try the sample.

How to use it

  1. Copy the raw headers of the message:
    • Outlook (classic desktop): open the message, File > Properties, copy everything in Internet headers.
    • New Outlook / Outlook on the web: open the message, … (More actions) > View > View message source (or View message details), select all and copy.
    • Gmail: open the message, ⋮ (More) > Show original > Copy to clipboard.
    • Apple Mail: select the message, View > Message > All Headers (or Raw Source, Option-Command-U) and copy the header lines.
  2. Paste into the box and click Analyze headers. Pasting the whole message is fine: parsing stops at the first blank line, where the body starts.
  3. Read the warnings first, then the authentication results (SPF, DKIM, DMARC, ARC), the hop-by-hop route in the order the message travelled (bottom Received header first) and, for Microsoft 365 mailboxes, the spam verdict fields.
  4. Look up who owns a sending IP with the ASN IP Lookup, and check the sender domain's DNS with the Email Deliverability Checker.

Audit hundreds of domains at once

Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).

Related email tools

Check the sending domain's DNS with the Email Deliverability Checker, SPF Checker, DMARC Checker and DKIM Explainer, or see who owns a sending IP with the ASN IP Lookup.

FAQ

How do I read email headers?

Received headers are added by each server, newest at the top, so read them from the bottom up to follow the message from sender to inbox. Authentication-Results shows the receiving server's SPF, DKIM and DMARC verdicts. From is what the reader sees; Return-Path is the envelope sender that bounces go to and that SPF checks.

Are my headers uploaded anywhere?

No. The parsing runs in JavaScript inside this page. Nothing you paste is sent to this site or any other server, so it is safe to analyze headers from internal mail.

What do SCL and BCL mean in Microsoft 365 headers?

SCL (spam confidence level) is Microsoft 365's spam verdict: -1 means filtering was skipped, 0 or 1 not spam, 5 or 6 spam (Junk Email folder) and 9 high confidence spam. BCL (bulk complaint level) runs from 0 to 9 and rates how many complaints a bulk sender gets; the default policy treats 7 or higher as bulk. Both appear in X-Forefront-Antispam-Report, X-Microsoft-Antispam and X-MS-Exchange-Organization-SCL.

Why does DMARC fail when SPF passes?

DMARC needs SPF or DKIM to pass for a domain that aligns with the From address. If a newsletter service sends with its own Return-Path domain, SPF passes for that domain but does not align, so DMARC then depends on a DKIM signature with d= set to your domain. Set up custom DKIM (and ideally a custom return-path) at the sending service.

Why is there a big delay or a negative delay between two hops?

Large delays usually mean queuing, greylisting, content scanning or a retry after a temporary failure at the next server. A negative delay means the two servers' clocks disagree, so the timestamps cannot be compared directly. Times are converted to UTC from the offset each server wrote.

Want the full kit?

Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.