Free email header analyser
Paste the header of any message to see whether it passed SPF, DKIM and DMARC, whether the domains align, and how long each server held it. Useful for spotting spoofed invoices and tracing slow delivery.
- Free, no sign-up
- Parsed in your browser, never uploaded
- Works with Outlook, Gmail and Apple Mail
Headers can contain names and email addresses. This page reads them in your browser and never sends them to MailMarq.
How to find an email header
Your email program hides the header. Here is where to find it.
OutlookClassic Outlook
Open the message in its own window, choose File, then Properties, and copy everything in the Internet headers box.
OutlookNew Outlook and web
Open the message, select More actions (the three dots), then View, then View message details. Copy all of it.
GmailGmail
Open the message, select More (the three dots next to Reply), then Show original. Choose Copy to clipboard.
MailApple Mail
Open the message, then choose View, Message, All Headers. Copy the header lines at the top.
What is an email header?
An email header is the block of technical lines above every message: who sent it, every server it passed through, and the results of the SPF, DKIM and DMARC checks the receiving server ran.
Your email program hides it, but it is the most reliable record of where a message really came from, and the first thing to check when an invoice or payment request looks wrong.
About this tool
- Parsing happens in your browser. The header is never uploaded.
- Results come from the Authentication-Results line your receiving server wrote. If it is missing, alignment is worked out from the other headers.
- Domains are matched at the organisational level using common suffixes such as co.za, which covers most cases but is not the full public suffix list.
What the analyser shows
dmarc=The verdict
Whether the message passed DMARC, and which check carried it.
d=Alignment
Whether the SPF and DKIM domains match the visible From address.
Reply-ToRed flags
Replies redirected to another domain, a common invoice fraud tactic.
ReceivedDelays
Every server hop in order, with the time spent at each one.
Email header questions
Short answers to what people ask most about reading headers.
How can I tell if an email is spoofed from its header?
Check three things: whether DMARC passed for the From domain, whether the DKIM signing domain matches the From domain, and whether the Reply-To points somewhere else. Treat a message that fails DMARC, or passes only for a different domain, as unverified, especially if it asks you to change banking details. See our banking details fraud checklist.
Why was an email delayed?
Each Received line records when a server accepted the message. A long gap between two hops shows where it waited, often in spam filtering, greylisting or a sending queue. A gap before the first hop usually means the sender’s own system held it.
What does dmarc=fail mean?
The message did not pass SPF or DKIM for a domain that matches the visible From address. Either someone is impersonating that domain, or a legitimate service sends for it without proper set-up. If it is your own domain, DMARC reports show which.
What does spf=softfail mean?
The sending server is not listed in the domain’s SPF record, and the record ends in ~all. Receivers treat the message as suspicious rather than rejecting it. If DKIM passes with alignment, DMARC can still pass.
Is it safe to paste email headers into an online tool?
Headers contain addresses, server names and sometimes internal IP addresses. This analyser reads them in your browser and sends nothing to our servers, which you can confirm by disconnecting from the internet before you press Analyse header. Avoid pasting the message body.
More free tools
Is someone sending email as your domain?
Headers show one message. DMARC reports show every message sent as your domain, by anyone. MailMarq reads them for you and stops the forgeries. From R3,290 a year.