How to get the raw headers
- Gmail: open the message, click the three dots next to Reply, choose Show original, then Copy to clipboard.
- Outlook on the web: open the message, choose … → View → View message source.
- Outlook for Windows: open the message, then File → Properties, and copy Internet headers.
- Apple Mail: select the message, then View → Message → All Headers (or Raw Source).
- Thunderbird: open the message and press Ctrl+U (Cmd+U on a Mac).
Pasting the whole source is fine: the analyzer stops at the first blank line, where the body starts.
What the results mean
The route. Every server that handles a message adds a Received line on top of the
others, so the headers read from newest to oldest. The analyzer turns them around and shows the hops in the order they
happened, with the time between each one. A few seconds is normal. Minutes usually mean a queue, greylisting or a retry
after a temporary error. A negative delay means one server's clock is wrong, not that mail travelled back in time.
SPF checks that the sending server is allowed to send for the envelope domain (the Return-Path).
DKIM checks a cryptographic signature that a domain added, so you know the message was not changed on
the way. DMARC checks that at least one of them passed for the domain in the From address you see,
and tells the receiver what to do if not. The results come from the Authentication-Results header your
own provider added when the message arrived.
Warnings point out things worth a second look: a Reply-To on a different domain, a missing Message-ID, a DKIM signature from an unrelated domain, or a hop that took far longer than the rest. Some of these are normal for newsletters and help desks; together with a DMARC failure they are a classic sign of phishing.
To check the sender's own setup, look up their records with the DMARC checker, the SPF checker or the DKIM lookup.
Questions
Is it safe to paste headers here?
Yes. The analyzer is plain JavaScript that runs in your browser tab. The headers are not uploaded, stored or logged, and the page works the same with your network switched off once it has loaded.
Why does the first hop have no delay?
A delay is the time between two Received stamps, so the first server in the chain has nothing to compare against. The total delivery time also counts from the Date header, which the sender's mail program sets.
SPF passed but DMARC failed. How?
DMARC needs SPF or DKIM to pass for a domain that matches the visible From address. SPF checks the envelope sender (Return-Path), which newsletter and billing services often set to their own domain. If that domain is not yours and there is no aligned DKIM signature, DMARC fails even though SPF passed.
Can headers be faked?
Everything below the first Received header your own provider added can be written by the sender. Trust the Authentication-Results header your provider added at the top, and read the rest of the chain as a claim, not proof.