📧 Email Header Analyser

In Gmail: open the email, click the three-dot menu (⋮) in the top-right of the message, and select "Show original". Outlook (web): open the email, click the three-dot menu, select "View" → "View message source". Outlook (desktop): double-click the email, go to File → Properties, and find the "Internet headers" box. Apple Mail: open the email, go to View → Message → All Headers. Copy everything from the header area (usually from "Delivered-To" or "Received" down to the blank line before the email body).

These are email authentication checks performed by the receiving mail server. SPF pass means the sending server's IP address is authorised by the domain's SPF record. DKIM pass means the email's cryptographic signature was verified — the message wasn't altered in transit and was sent by an authorised server. DMARC pass means at least one of SPF or DKIM passed and the authenticated domain aligns with the From: address. If any of these fail, the email may be treated as spam or rejected, depending on the domain's DMARC policy.

"Received" headers record every mail server the email passed through on its way to you, from the originating server to your mailbox. They're listed in reverse order — the most recent hop is at the top, and the original sender's server is at the bottom. Analysing the Received chain can tell you: where the email originated, how long it took to deliver (compare timestamps between hops), whether it passed through expected relay servers, and whether it was routed unusually (which can indicate spoofing or misconfiguration).

"None" for SPF or DKIM means the check was not performed, usually because the domain does not have the relevant DNS records. "None" for DMARC typically means there is no DMARC policy for the sending domain. In contrast, a "fail" or "permerror" means records exist but the check failed. If you're sending email and recipients see "none", you need to set up SPF, DKIM, or DMARC on your domain. Use the other tools on this site to check and configure your records.

The X-Spam-Score header is added by spam filtering software (such as SpamAssassin) on the receiving mail server. A higher score generally means the email is more likely to be spam. The threshold that triggers spam filtering varies by server configuration — commonly anything above 5.0 or 6.0 is marked as spam. A X-Spam-Status: Yes header means the message was classified as spam by that server. If your legitimate emails have a high spam score, analyse the individual rules triggered (often listed in X-Spam-Report) and address them — common causes are missing authentication records, HTML-heavy content, or blacklisted sending IPs.