What is email header analysis?

It is reading the hidden headers of a message to find out where it came from, how it was authenticated and how it was delivered. The headers record each server that handled the message, the SPF, DKIM and DMARC results, and any spam filter scores.

Can email headers show the sender's IP address or location?

They show the IP address of each server that handed the message on, and the analyzer lists them per hop. Most webmail providers, including Gmail, do not record the sender's own device address, so the earliest IP is usually the provider's server. This tool does not geolocate addresses, and IP location is approximate at best.

How do I view message headers in new Outlook or Outlook on the web?

Open the message, select More actions (the three dots), then View, then View message details. Copy everything in the window and paste it into the analyzer above.

Is it safe to paste my email headers into this tool?

Yes. The analyzer runs entirely in your browser and the headers are never uploaded or sent to our server. Headers can still contain names, addresses and internal server names, so treat them like any other private data when you share them elsewhere.

Which Authentication-Results header should I trust?

The one added by your own mail provider, which is normally the topmost Authentication-Results header. Headers lower down were written by earlier servers, and anything above the first Received line from your provider could have been added by the sender, so it proves nothing.

What does spf=softfail mean?

The server that sent the message is not listed in the SPF record of the envelope sender's domain, and that record ends in ~all, which asks receivers to accept the message but treat it with suspicion. It usually means a sending service was never added to the SPF record.

Why does DMARC fail when SPF or DKIM passes?

DMARC needs a pass that is aligned with the From domain. SPF can pass for an email service's bounce domain and DKIM can pass for the service's own signing domain, and neither counts unless that domain matches the From domain, exactly or at the organisational level under relaxed alignment.

How do I find out why an email was delayed?

Read the Received headers from the bottom up. Each one records when a server accepted the message, so the gap between two consecutive timestamps is the time spent at the earlier server. The analyzer computes those gaps and highlights the largest. Negative gaps mean a server clock is wrong.

Email header analyzer

In short: Paste raw headers to see SPF, DKIM and DMARC results, alignment, every hop with its delay, and spam verdicts. Limit: It reads what the headers say. It does not re-verify DKIM signatures or re-run SPF, so it relies on the receiving server's Authentication-Results.

An email header analyzer reads the raw headers of a message and explains them. Paste the headers or open a .eml file, and this tool shows the SPF, DKIM and DMARC results, whether they align with the From address, every server the message passed through with the delay at each hop, and any spam verdicts. It runs in your browser.

Raw email headers or a full .eml message

Everything runs in your browser. Your headers are never uploaded or sent to our server.

By SimpleVerifier Team · Last updated October 17, 2026 · Runs in your browser; the headers you paste are never sent to us

SimpleAPI

Sample result

This email from acme.example passed SPF, DKIM and DMARC.

From domain: acme.example
DKIM: Pass, aligned
Transit: 3s

What this means for you

The sender's authentication worked, so a spam-folder landing has another cause.

Next step:Run the full deliverability audit

Reads SPF, DKIM and DMARC results
Checks alignment with the From domain
Every hop with the delay before it
Decodes spam verdict headers

Headers
DMARC
Hops

SimpleAPI

Sample result

This email from acme.example passed SPF, DKIM and DMARC.

From domain: acme.example
DKIM: Pass, aligned
Transit: 3s

What this means for you

The sender's authentication worked, so a spam-folder landing has another cause.

Next step:Run the full deliverability audit

Reads SPF, DKIM and DMARC results
Checks alignment with the From domain
Every hop with the delay before it
Decodes spam verdict headers

Headers
DMARC
Hops

How do I view email headers in Gmail, Outlook and Apple Mail?

Each client has a “show original” or “message details” view that shows the full headers. Copy the headers from the recipient’s mailbox, not the sender’s Sent folder. The authentication results and most of the delivery path are only added on arrival.

Gmail: open the message, click More next to Reply, choose Show original, then Copy to clipboard (Google’s instructions).
Outlook on the web and new Outlook for Windows: select More actions at the top of the message, then View, then View message details. In classic Outlook, double-click the message to open it, choose File, then Properties, and copy the Internet headers box (Microsoft’s instructions).
Apple Mail on Mac: choose View, then Message, then All Headers. View, Message, Default Headers switches back (Apple’s instructions).

How do I read email headers?

Read them in two passes: the authentication results first, then the delivery path from the bottom up. Start with the topmost Authentication-Results header, because your own provider wrote it. Every server adds its headers above the ones already there, so anything lower down came from earlier servers and anything a sender wrote can be forged. ARC-Authentication-Results headers are copies kept by forwarders and mailing lists, so the original result survives when forwarding breaks SPF or DKIM.

Then read the Received headers from the bottom up. The bottom one is the first server to accept the message and the top one is the last. The gap between two timestamps is the time the message waited at the earlier server, which is how you find the hop that held it for an hour. The protocol word matters too: ESMTPS means the connection used TLS, ESMTPA means the sender logged in, and ESMTPSA means both.

What do dkim=pass, spf=softfail and dmarc=fail mean?

They are the receiving server’s verdicts, recorded in the Authentication-Results header in the format set by RFC 8601. The three you will see most:

dkim=pass: A signature on the message verified against the public key published by the domain in header.d, so the signed headers and body have not changed since that domain signed them. It says nothing about the From address unless that domain matches it. To inspect the key itself, run the selector through the DKIM checker.
spf=softfail: The sending IP is not in the SPF record of the envelope sender (smtp.mailfrom), and the record ends in ~all, which asks receivers to accept but mark the message. A hard spf=fail means the record ends in -all. Both usually mean a sending service is missing from the record. The SPF checker shows what is actually authorised.
dmarc=fail: Neither SPF nor DKIM passed with a domain aligned to the From address. The receiver then applies the domain’s policy: nothing for p=none, the spam folder for p=quarantine, rejection for p=reject. Check the policy with the DMARC checker.

How do I read email headers for phishing?

Check three things: whether DMARC passed for the From domain, whether the Reply-To or Return-Path points somewhere else, and whether the first server in the path belongs to the organisation the message claims to be from. A message that says it is from your bank but fails DMARC, or passes only for an unrelated domain, did not come from your bank’s mail servers. The same headers explain most ordinary delivery problems too:

SPF and DKIM pass but DMARC fails. An email service is using its own bounce domain and signing with its own domain. Set up a custom return-path and DKIM on your domain in that service.
DKIM fails with “body hash did not verify”. Something changed the message after signing, usually a mailing list footer, a security gateway or a forwarding rule.
A Reply-To on another domain. Normal for help desks and some email services, and also the classic sign of a phishing message that wants your answer to go somewhere else.
One hop holds the message for minutes or hours. A large gap at the sender’s side points to a queue or throttling; at the receiving side it often means greylisting or content scanning.

For a full walk through a real header, see how to read email headers to debug deliverability problems. If mail is landing in spam at Gmail specifically, see why your emails go to spam in Gmail. To check a sending domain’s records all at once, run the deliverability audit.

How do I analyze email headers?

Open the message in the recipient's mailbox and copy the full headers: Show original in Gmail, View message details in Outlook, All Headers in Apple Mail.
Paste them into the box above, or press Open .eml file to load a saved message. Load example shows what a full result looks like.
Press Analyze headers and read the topmost Authentication-Results first. Your own provider wrote it, so it is the one to trust.
Check "Alignment with the From domain" (DMARC only counts an SPF or DKIM pass whose domain matches the From address), then read the hops from the bottom up and the spam filter verdicts such as X-Spam-Status and Microsoft's SCL and BCL.

Example

You enter: The full raw headers of a message from acme.example, pasted or loaded from a saved .eml file.
You get: SPF passed, DKIM passed for 1 of 1 signature and DMARC passed, with DKIM aligned to the From domain. Every hop is listed with its delay, 3 seconds in transit in total.
Limits: Runs in your browser, so nothing is uploaded; .eml files up to 5 MB.

Is this different from Gmail's Show original?

Show original is where you copy the headers from. It summarises SPF, DKIM and DMARC, and stops there:

	This analyzer	Gmail Show original
SPF, DKIM and DMARC results	Yes, from every Authentication-Results and ARC header	Yes, Gmail's own result
Alignment with the From domain	Checked and explained	Not shown
Delay at each hop	Calculated, largest highlighted	Raw timestamps only
Microsoft SCL, BCL and spam filter headers	Decoded	Not applicable
Works on mail from any provider	Yes, paste or .eml	Gmail messages only

Who uses this tool, and for what?

IT admins: Find out why a vendor's invoice landed in junk, or whether a suspicious message really came from the domain in its From line. A Reply-To on another domain is flagged.
Cold emailers: Send a test from a new outreach domain to a Gmail or Outlook inbox you own, paste the headers, and confirm dkim=pass with your own domain in header.d= before the first campaign.
Agencies: When a client's newsletter starts going to spam, check whether their email service signs with the client's domain or its own. SPF and DKIM can both pass while DMARC fails.
SaaS teams: Track down slow password-reset and sign-up emails. The hop list shows which server held the message, and for how long.

What can’t this tool tell you?

It reads what the headers say. It does not re-verify DKIM signatures or re-run SPF, so it relies on the receiving server's Authentication-Results.
Alignment is approximate: it matches organisational domains with a built-in list of common suffixes, not the full Public Suffix List a real DMARC check uses.
Anything below your provider's first Received line was written by earlier servers or the sender, and can be forged. The tool cannot tell a forged header from a real one.
Hop delays depend on each server's clock. A negative or very large gap usually means a clock is wrong, not that a server was slow.
Spam verdict headers differ by provider. Gmail adds very few, so a message received at Gmail may show no spam score at all.

Sources

Common questions

What is email header analysis?: It is reading the hidden headers of a message to find out where it came from, how it was authenticated and how it was delivered. The headers record each server that handled the message, the SPF, DKIM and DMARC results, and any spam filter scores.
Can email headers show the sender's IP address or location?: They show the IP address of each server that handed the message on, and the analyzer lists them per hop. Most webmail providers, including Gmail, do not record the sender's own device address, so the earliest IP is usually the provider's server. This tool does not geolocate addresses, and IP location is approximate at best.
How do I view message headers in new Outlook or Outlook on the web?: Open the message, select More actions (the three dots), then View, then View message details. Copy everything in the window and paste it into the analyzer above.
Is it safe to paste my email headers into this tool?: Yes. The analyzer runs entirely in your browser and the headers are never uploaded or sent to our server. Headers can still contain names, addresses and internal server names, so treat them like any other private data when you share them elsewhere.
Which Authentication-Results header should I trust?: The one added by your own mail provider, which is normally the topmost Authentication-Results header. Headers lower down were written by earlier servers, and anything above the first Received line from your provider could have been added by the sender, so it proves nothing.
What does spf=softfail mean?: The server that sent the message is not listed in the SPF record of the envelope sender's domain, and that record ends in ~all, which asks receivers to accept the message but treat it with suspicion. It usually means a sending service was never added to the SPF record.
Why does DMARC fail when SPF or DKIM passes?: DMARC needs a pass that is aligned with the From domain. SPF can pass for an email service's bounce domain and DKIM can pass for the service's own signing domain, and neither counts unless that domain matches the From domain, exactly or at the organisational level under relaxed alignment.
How do I find out why an email was delayed?: Read the Received headers from the bottom up. Each one records when a server accepted the message, so the gap between two consecutive timestamps is the time spent at the earlier server. The analyzer computes those gaps and highlights the largest. Negative gaps mean a server clock is wrong.

Headers explain what happened to one message. Bounces come from the list: to find addresses that will hard-bounce before you send, use the free email checker or see pricing for whole lists.

Embed this tool on your site

Paste this code into any page to give your readers the email header analyzer for free. The frame resizes to fit and works on light and dark pages. Keep the link under it so readers can find the full guide. More tools to embed are on the embeddable tools page.

HTML

<iframe src="https://simpleverifier.com/embed/tools/email-header-analyzer" title="Email header analyzer by SimpleVerifier" data-sv-embed="email-header-analyzer" width="100%" height="640" loading="lazy" allow="clipboard-write" style="border:0;width:100%;max-width:760px;display:block"></iframe>
<p style="margin:6px 0 0;font-size:13px"><a href="https://simpleverifier.com/tools/email-header-analyzer">Free email header analyzer by SimpleVerifier</a></p>
<script>(function(){if(window.__svEmbed)return;window.__svEmbed=1;window.addEventListener("message",function(e){if(e.origin!=="https://simpleverifier.com")return;var d=e.data;if(!d||d.type!=="simpleverifier:embed-height"||typeof d.slug!=="string"||typeof d.height!=="number"||!isFinite(d.height))return;var f=document.querySelectorAll("iframe[data-sv-embed]");for(var i=0;i<f.length;i++){if(f[i].contentWindow===e.source){f[i].style.height=Math.min(Math.max(Math.ceil(d.height),200),4000)+"px";}}});})();</script>