Trust beats tactics™

Reputation & monitoring

Email Header Analyzer

Paste raw email headers, or drop in a full .eml file. We pull out the authentication verdicts, walk every server in the Received chain, and surface anything a recipient added that looks like a spam score.

New to headers? Read What are email headers in the Email Almanac.

We parse the headers server-side. The message body, if any, is dropped before parsing and never stored.

How this tool works

What the analyzer is actually doing

  1. 1

    Authentication verdicts

    SPF, DKIM and DMARC results are pulled from Authentication-Results, falling back to Received-SPF and the presence of a DKIM-Signature when no consolidated verdict was written.

  2. 2

    Sender alignment

    From, Reply-To and Return-Path are extracted side by side. If Reply-To routes to a different domain than From, we flag it. Common in ticketing systems and forwarders, also a cheap phishing tell.

  3. 3

    Hop chain and delivery time

    Every Received header is parsed into originating server, receiving server, protocol and timestamp. Sudden gaps between hops usually mean a queue backlog or a greylist.

  4. 4

    Spam scoring signals

    Every header added by a SpamAssassin, rspamd, Barracuda, Microsoft Anti-Spam or Proofpoint filter is surfaced with the score, threshold and rules that fired.

  5. 5

    Nothing is kept

    Parsing happens on our server on a single request. If you paste a full .eml file the body is dropped first. We do not log the headers, we do not write them to disk, and we do not send them anywhere else.

Example route, read from the bottom up

  1. inboxThe end of the trail
  2. mx.example.net41 minutes. A long gap is a queue, a greylist or a relay under load.
  3. relay.example.org2 seconds
  4. mail.example.comThe first server to handle it

When to use it

Reach for it in these moments

  • A message bounced or hit spam

    You have the .eml. The analyzer surfaces every authentication verdict and every spam-filter score the receiver wrote, so you see exactly what they did not like.

  • A user reports a suspicious email

    Pull the raw headers. Check From vs Return-Path vs the actual sending IP. If they do not line up, you have your answer.

  • A message took unusually long

    The hop chain shows the time between each receive event. A long gap on one hop is a queue, a greylist, or a relay under load.

  • You changed your authentication setup

    Send yourself a test, paste the headers, and check that SPF, DKIM and DMARC all say pass with alignment.

Email Almanac

  • Not sure what this means?

    Ask a real person. The Email SOS Hotline is free help with any email problem, no pitch.

    Ask the Email SOS Hotline

  • Keep this result

    Send it to your inbox, to share with your team or compare after a fix.

    Run a check, then email it

  • This reads one message. Your list decides who gets the next one.

    Mailbox providers judge you on who you send to, not only on what one message looks like. Clean your first 1,000 addresses free.

    Clean your first 1,000 free