Free Tool

Email Header Analyzer

Analyze email headers to trace delivery path, verify authentication results, and diagnose deliverability issues.

100% client-side — your headers never leave your device

What are Email Headers?

Email headers are the metadata attached to every email message. While most email clients only show the From, To, Subject, and Date fields, the full headers contain a wealth of technical information including the complete delivery path, server identities, authentication results, and spam filter scores.

Every mail server that processes an email adds its own headers to the message. The most important are Received headers, which create a traceable chain from the originating server to the final destination. By analyzing these headers, you can identify where delays occurred, which servers handled the message, and whether the email was properly authenticated.

Header analysis is invaluable for troubleshooting deliverability issues. If emails are landing in spam, headers reveal whether SPF, DKIM, or DMARC checks failed, what spam scores were assigned, and which server made the filtering decision.

Frequently Asked Questions

What information is in email headers?
Email headers contain the full technical metadata of a message: the complete delivery path (Received headers), sender and recipient addresses, timestamps, message ID, MIME version, content type, and authentication results. Authentication headers include Authentication-Results (SPF, DKIM, DMARC outcomes), DKIM-Signature (the cryptographic signature), and spam filter headers like X-Spam-Status and X-Spam-Score.
How do I find email headers in Gmail/Outlook?
In Gmail: open the email, click the three-dot menu (More), and select 'Show original'. The full headers appear at the top of the raw message view. In Outlook (web): open the email, click the three-dot menu, select 'View' then 'View message details'. In Outlook desktop: open the email, go to File > Properties and look in the Internet headers box. In Apple Mail: open the email, go to View > Message > All Headers.
What does the 'Received' header mean?
Each 'Received' header represents one hop in the email's delivery path — one mail server handing off to another. Reading from bottom to top, the bottommost Received header is the originating server (where the email was injected), and the topmost is the final delivery server (your inbox). Each Received header includes a timestamp, the server's hostname and IP, and the protocol used. Large time gaps between consecutive Received headers indicate delivery delays.
How can email headers detect spoofing?
Check the 'Authentication-Results' header for SPF, DKIM, and DMARC results. If SPF fails, the sending server is not authorized by the domain's SPF record. If DKIM fails, the message signature is invalid. If DMARC fails, the visible From domain doesn't align with the authenticated domain. Also compare the 'From' header (visible to you) against the 'Return-Path' (the actual envelope sender) — mismatches indicate potential spoofing.
What is the X-Spam-Status header?
X-Spam-Status is a header added by spam filters (like SpamAssassin) indicating whether the email was classified as spam and the score it received. A typical value looks like 'Yes, score=8.5 required=5.0' — meaning the email scored 8.5 points, above the 5.0 threshold for spam classification. The header often includes a list of triggered rules (tests), which helps diagnose why legitimate emails are being flagged.

Need continuous email monitoring?

Get automatic alerts when your email authentication records change. Monitor SPF, DKIM, DMARC, and 60 blacklists.

Start Monitoring Free