Email header analyzer
Paste the raw headers of a message to trace each hop and find the slowest one, read SPF, DKIM and DMARC, spot a spoofed From or Reply-To, and decode Microsoft 365 spam headers (SCL, SFV, CAT, PCL, BCL) in plain English.
Runs entirely in this browser; the headers are not uploaded or stored. Before you share a report or the headers with anyone outside your company, redact personal and internal details: names and mailbox addresses, internal host names and IP addresses, tenant IDs and message IDs. The copy button masks only the part of an address before the @. Header values can be forged, so treat this as a guide, not proof.
Reading email headers: common questions
How do I get the full headers?
Outlook on the web: open the message, choose More actions (the three dots), then View, then View message details. Classic Outlook: double-click the message, then File, Info, Properties, and copy the Internet headers box. Gmail: three dots, then Show original. Apple Mail: View, Message, All Headers. Copy the headers from the mailbox that received the message, not from a forwarded copy.
Which hop made the message late?
Each Received header carries the time that server handled the message. Read from the bottom up, the gap between two hops is the delay at that step. This page converts every time to UTC, so mixed time zones do not matter, and it marks a hop that appears to travel back in time as clock skew instead of counting it.
Why can DMARC fail when SPF or DKIM passes?
DMARC needs a pass that is aligned: the domain SPF checked (the envelope sender) or the domain that signed with DKIM (d=) must match the visible From domain. A newsletter service often passes SPF and DKIM for its own domain, which does not help the sender's domain.
What do SCL, SFV and CAT mean?
SCL is the spam confidence level (-1 skipped, 0 and 1 not spam, 5 and 6 spam, 7 to 9 high confidence spam). SFV is the filter verdict, for example NSPM for not spam or SPM for spam. CAT is the detection category, for example PHSH for phishing or SPOOF for spoofing. All three appear in the table above when the headers include them.
Can I trust what the headers say?
Only the headers added by your own receiving server are reliable, mainly the top-most Authentication-Results and Received lines. Earlier Received lines are written by the sender's side and can be forged. A message can pass SPF, DKIM and DMARC and still be unwanted.
What this does not do: it does not verify DKIM signatures or look up DNS, it does not decide whether a message is safe, and it cannot see inside the message body or attachments. It works out DMARC alignment from the headers using the default relaxed mode and a built-in list of common two-part domain endings, and it trusts the receiving system's own reported result when the two disagree. Times come from servers whose clocks may be wrong. For a live check of a domain's records use the Email Health Check or the MX and email DNS checker.