--- title: "Email Header Analyzer: SPF, DKIM, DMARC & Delays | Prosyo" description: "Free email header analyzer: paste raw headers to see SPF, DKIM and DMARC results, every server hop and delay, spam scores and why mail went to spam." url: "https://prosyo.com/tools/email-header-analyzer/" image: "https://prosyo.com/wp-content/uploads/2026/10/cropped-Prosyo-Icon-Transparent-1.png" language: "en" --- Free Tools # Email Header Analyzer Paste raw email headers to see SPF, DKIM and DMARC results, every server hop with its delay, and why a message landed where it did. Email Header AnalyzerInstant · results in seconds 100% free 1. 1Fill in 2. 2Run the check 3. 3Fix & use What you get - A plain-English verdict in seconds - Every record found, with what it means - The exact fix for anything that fails **Agent Penny***Your AI SDR* **Do this for every prospect, automatically** Penny finds your buyers, writes personal LinkedIn and email outreach, sends it from your own accounts and drafts every reply. [Start free, 7 days](https://app.prosyo.com/?utm_source=prosyo-tools&utm_medium=tool-side&utm_campaign=email-header-analyzer) No card required · Cancel in two clicks **Run outbound on autopilot**Personal LinkedIn and email outreach, sent from your accounts, replies drafted for you.[Start free, 7 days](https://app.prosyo.com/?utm_source=prosyo-tools&utm_medium=article&utm_campaign=email-header-analyzer)No card required ## What is an email header analyzer? An email header analyzer reads the hidden technical headers attached to every email and turns them into something you can act on. Headers record who really sent a message, which servers handled it, how long each step took, and whether it passed SPF, DKIM and DMARC. When an email lands in spam, arrives late, or looks like it might be a phishing attempt, the headers hold the answer. Raw headers are long, folded across lines and written for machines. This free email header analyzer parses them in your browser and shows the authentication results with what each one means, every server hop in order with the delay at each step, whether the sending domains are aligned, any spam-filter scores Microsoft or another filter added, the key fields such as From, Return-Path and Message-ID, and specific fixes for anything that failed. Nothing you paste is sent to our server. ## Key takeaways - Look at the Authentication-Results header first: spf, dkim and dmarc should all say pass. - DMARC needs alignment: SPF or DKIM must pass for the same domain as the From address. - Received headers read bottom to top; the analyzer orders them oldest first for you. - Long delays at one hop usually mean greylisting, a busy filter or a queue. - Microsoft’s SCL of 5 or more means the message was treated as spam. ## How to get the raw headers | Email client | Where to find the headers | | --- | --- | | Gmail (web) | Open the email, click the three-dot menu, then “Show original”. Copy everything above the message body. | | Outlook (web) | Open the email, click the three-dot menu, then “View” and “View message details”. | | Outlook (desktop) | Open the email in its own window, then File, Properties, and copy “Internet headers”. | | Apple Mail | Open the email, then View, Message, “All Headers” (or Raw Source). | | Yahoo Mail | Open the email, click the three-dot menu, then “View raw message”. | | Thunderbird | Open the email, then View, “Message Source”. | Paste the whole block. The analyzer ignores the body if it is included. **Free tools fix one email. Prosyo fixes the pipeline.**Penny researches every buyer, writes personal LinkedIn and email outreach and books the meetings, from your own accounts. [Try Prosyo free](https://app.prosyo.com/?utm_source=prosyo-tools&utm_medium=article&utm_campaign=email-header-analyzer) ## How to use the email header analyzer 1. **Copy the raw headers** using the steps above. 2. **Paste them** into the box. Try the example first if you want to see what a healthy message looks like. 3. **Press “Analyze headers”.** 4. **Read the verdict and the three tiles** for SPF, DKIM and DMARC. 5. **Work through anything marked amber or red**; each item says what to fix. 6. **Check the delivery path** for slow hops and unexpected servers. ## What the analyzer reads ### Authentication-Results The receiving server adds this header after checking the message. It records the result of each check, for example `spf=pass`, `dkim=pass header.d=yourcompany.com` and `dmarc=pass header.from=yourcompany.com`. The analyzer reads the top-most one, which was added by the final receiving system, and falls back to ARC-Authentication-Results or Received-SPF when it is missing. | Result | Meaning | | --- | --- | | `pass` | The check succeeded. | | `fail` | The check failed: the server is not authorised (SPF) or the signature does not verify (DKIM). | | `softfail` | SPF says the server is probably not authorised (`~all`). | | `neutral` / `none` | No usable statement, often because no record exists. | | `temperror` / `permerror` | A DNS problem, or a broken record such as too many SPF lookups. | ### Alignment The analyzer compares three domains: the visible From domain, the DKIM signing domain (`d=`) and the envelope sender (`smtp.mailfrom` or Return-Path). DMARC passes only if SPF or DKIM passes for a domain that matches the From domain. Misalignment is the most common reason legitimate mail from third-party tools fails DMARC. ### Received headers and delays Every server that handles a message adds a Received header at the top, so they read newest first. The analyzer reverses them, shows each hop’s sender, receiver and protocol, and calculates how long the message waited between hops. A few seconds per hop is normal. Minutes at one hop usually mean greylisting (the receiver deliberately delays first-time senders), a busy spam filter, or a queue on the sending side. ### Spam scores Some filters write their verdict into the headers. Microsoft 365 adds a Spam Confidence Level (SCL) from -1 to 9; 5 or above goes to Junk. SpamAssassin-based filters add X-Spam-Status with a score and the rules that fired. When these headers are present, the analyzer shows them with a plain explanation. ### List-Unsubscribe Gmail and Yahoo require bulk marketing senders to include a List-Unsubscribe header with one-click unsubscribe. The analyzer notes whether it is present. One-to-one cold email sent from a normal mailbox does not usually have it. ## Diagnosing common problems | What you see | Likely cause | Fix | | --- | --- | --- | | `spf=fail` or `softfail` | The sending server is missing from SPF. | Add the service to SPF with the [SPF Generator](https://prosyo.com/tools/spf-generator/). | | `spf=permerror` | Two SPF records, or more than 10 lookups. | Run the [SPF Checker](https://prosyo.com/tools/spf-checker/) and merge or trim the record. | | `dkim=none` | The message was not signed. | Turn on DKIM signing in your email provider and publish its key. | | `dkim=fail` | The key in DNS is wrong or missing, or the message was altered in transit. | Check the selector with the [DKIM Checker](https://prosyo.com/tools/dkim-checker/). | | `dmarc=fail` with SPF and DKIM passing | Alignment: they passed for another domain. | Authenticate your own domain inside the sending service so it signs with it. | | SCL 5 or higher | Microsoft filtered it as spam. | Check authentication, list quality and content; see the [Spam Word Checker](https://prosyo.com/tools/spam-word-checker/). | | Long delay at one hop | Greylisting or a busy filter. | Usually nothing to fix; consistent delays at your own server deserve a look. | ## Using headers to spot phishing Headers are the quickest way to check a suspicious message. Warning signs include a From address on one domain with a Return-Path or DKIM signature from a different, unrelated domain; `dmarc=fail` for a well-known brand; a Reply-To that points somewhere else entirely; and a delivery path that starts at an unexpected server. If a message claiming to come from your bank or a colleague fails DMARC, treat it as fake. ## Headers and cold email deliverability If your outreach lands in spam, send a test from the real sending inbox to your own Gmail and Outlook accounts, then paste the headers here. Clean results look like this: SPF pass, DKIM pass with your domain, DMARC pass, low or no spam score, and a short delivery path. If authentication passes and mail still goes to spam, the cause is usually reputation, volume or content rather than setup: check the domain with the [Domain Health Checker](https://prosyo.com/tools/domain-health-checker/), the list with the [Email Verifier](https://prosyo.com/tools/email-verifier/) and the copy with the [Cold Email Grader](https://prosyo.com/tools/cold-email-grader/). ## Worked example Priya’s emails to prospects keep landing in spam. She pastes the headers from one of her own sent emails, received in a test Outlook account. The analyzer shows `spf=pass`, `dkim=pass` with `d=sendingtool.com`, and `dmarc=fail`. The alignment check explains why: DKIM passed for the sending tool’s domain, not hers, and SPF passed for the tool’s return-path. She completes the “authenticate your domain” step in the sending tool, sends another test, and the analyzer now shows DKIM passing with her own domain and DMARC passing. Inbox placement improves within days. ## Privacy Headers can contain email addresses and internal server names. This tool parses everything in your browser; nothing you paste is uploaded or stored. You can safely use it on internal mail. ## Glossary - **Header**: a line of metadata at the top of an email, such as From, Date or Received. - **Hop**: one server passing the message to the next. - **Return-Path / envelope sender**: the bounce address SPF is checked against. - **ARC**: Authenticated Received Chain, which preserves authentication results through forwarding. - **SCL**: Microsoft’s Spam Confidence Level, from -1 to 9. ## How Prosyo helps Prosyo sends outreach from your own authenticated mailboxes and LinkedIn account, at safe daily volumes, and stops the moment someone replies, so the signals mailbox providers read stay healthy. It writes personal first lines from what each prospect actually did and drafts every reply. [Start a 7-day free trial](https://prosyo.com/pricing/), no card required. ## Related free tools These tools are often used together with the Email Header Analyzer. All of them are free and run in your browser. - [Domain Health Checker](https://prosyo.com/tools/domain-health-checker/): Score MX, SPF, DKIM, DMARC, BIMI, MTA-STS and blocklists in one click. - [DMARC Generator](https://prosyo.com/tools/dmarc-generator/): Build a DMARC record with reporting and a safe path to p=reject. - [SPF Generator](https://prosyo.com/tools/spf-generator/): Build one valid SPF record with the lookup count checked live. - [Blacklist Checker](https://prosyo.com/tools/blacklist-checker/): Check a domain and its mail servers against widely used blocklists. ## Frequently asked questions ### How do I read email headers? Copy the raw headers from your email client and paste them into the analyzer above. It shows authentication results, every server hop with its delay, and fixes for anything that failed. ### How do I see the headers in Gmail? Open the email, click the three-dot menu and choose Show original. Copy the text above the message body. ### How do I check if an email passed SPF, DKIM and DMARC? Look at the Authentication-Results header, or paste the headers here. Each check shows pass, fail or another result with an explanation. ### Why did my email go to spam? Headers show whether authentication failed or a filter scored the message as spam. If everything passes, the cause is usually sender reputation, list quality, volume or content. ### What does dmarc=fail mean when SPF and DKIM pass? They passed for a domain that does not match the From address. Set up the sending service to sign DKIM with your own domain. ### What is SCL in Microsoft headers? The Spam Confidence Level Microsoft assigns, from -1 to 9. A value of 5 or above sends the message to Junk. ### Is it safe to paste headers here? Yes. The analysis runs entirely in your browser and nothing is sent to our server. ## Ready to Accelerate Your Growth? Launch smarter campaigns, convert more leads, and scale your business with ease — all in one place. [Get Started Now](https://prosyo.com/) [Book a Demo](https://prosyo.com/pricing/)