Free email header analyzer

In Gmail, open the message, click the three-dot menu and choose Show original, then copy the block of text. In Outlook on the web, open the message menu and choose View, then View message source. In Apple Mail, use View, then Message, then Raw Source.

SPF says whether the sending server was allowed to send for that domain. DKIM says whether the message was signed by the domain and arrived unmodified. DMARC ties the two to the From address you actually see. A pass on all three means the From address is very likely genuine.

The From line and most Received lines can be forged by the sender. The Received lines added by servers you trust, and the authentication results your own provider stamped on arrival, cannot. Read the analysis from the bottom hop upward and trust the top entries most.

Each hop carries a timestamp, so a long gap between two Received lines shows exactly which server held the message. Greylisting at the receiving end is the most common cause of a delay measured in minutes; queue backlogs at the sender cause the longer ones.

No. Parsing happens on the server for the length of the request and nothing is written to a database or a log. Headers can contain internal hostnames and recipient addresses, so nothing is kept after the response is sent.