Skip to content

Free tool

Email Header Analyzer

Paste the raw headers of any message to see who sent it, whether SPF, DKIM and DMARC passed, whether unsubscribe meets RFC 8058, and how long each server held it. Headers are parsed in your browser and never uploaded.

In Gmail use Show original, in Outlook open the message properties. Parsing runs in your browser: the headers are never sent to a server.

What the email header analyzer does

An email header analyzer turns the raw header block of a message into something readable. It unfolds wrapped lines, reads Authentication-Results for SPF, DKIM, DMARC and ARC verdicts, lists DKIM signatures by domain and selector, checks the List-Unsubscribe headers against RFC 8058, and puts the Received headers oldest first so you see each hop and the delay between them.

How it works

How the Email Header Analyzer works

  1. Copy the raw headers

    In Gmail choose Show original. In Outlook open the message properties or source. Paste the whole block, or try the example.

  2. Parsed in your browser

    Wrapped lines are unfolded and every field is read locally, following RFC 5322 and RFC 8601. The headers are never uploaded.

  3. Read verdicts and the path

    See SPF, DKIM, DMARC and ARC results, one-click unsubscribe status and every hop oldest first, with the delay between them.

Reading your result

What the authentication results mean

  • pass

    The receiving server confirmed the check. For DMARC, pass means SPF or DKIM passed and aligned with the domain in the From address.

  • fail

    The check failed. Mail that fails DMARC on a domain with p=reject is usually refused, and with p=quarantine it goes to spam.

  • softfail, neutral or temperror

    Not a clean pass. softfail means the sending IP is not in an SPF record that ends in ~all. temperror points to a DNS problem at the time of the check.

  • none

    Nothing to check: no SPF record, no DKIM signature, or no DMARC record for the From domain.

  • Domain mismatch

    Return-Path or Reply-To uses a different domain from From. Normal for many sending platforms and help desks, and also a common phishing pattern, so read it with the DMARC result.

What is DKIM? What is DMARC? One-click unsubscribe

Headers the analyzer reads

Authentication-Results
Added by the receiving server. Records the SPF, DKIM, DMARC and ARC verdicts, with properties such as smtp.mailfrom, header.d and header.from.
DKIM-Signature
The signing domain (d=), selector (s=) and algorithm (a=). The public key lives at selector._domainkey.domain.
ARC-Seal and friends
Added by forwarders and mailing lists so the original authentication results survive the extra hop.
Received
One per server hop, newest at the top: which host sent it, which host took it, over what protocol and when.
Return-Path
The envelope sender, where bounces go. SPF checks this domain.
List-Unsubscribe
Where the mailbox provider's unsubscribe button sends the request. With List-Unsubscribe-Post it becomes one-click.

FAQ

Email header analyzer FAQ

How do I find the raw headers of an email?

In Gmail, open the message, choose the three-dot menu and then Show original. In Outlook for Windows, open the message, choose File, then Properties, and copy the Internet headers box. In Apple Mail, choose View, then Message, then All Headers. Copy everything above the message body.

Why are Received headers read from the bottom up?

Each server that handles a message adds its own Received line at the top of the header block. The bottom line is therefore the first hop, usually the sender's own server, and the top line is the last hop into the recipient's mailbox. The analyzer reverses them so the path reads in order.

What does a long delay between two hops mean?

The receiving server held the message before passing it on. Common causes are greylisting (a deliberate temporary deferral of unknown senders), a queue on a busy server, or content and attachment scanning. A negative delay means the two servers' clocks disagree.

What makes unsubscribe one-click compliant?

RFC 8058 needs three things: an HTTPS URI in List-Unsubscribe, a List-Unsubscribe-Post header with the value List-Unsubscribe=One-Click, and a valid DKIM signature that covers both headers. Gmail and Yahoo expect one-click unsubscribe on bulk marketing mail. The analyzer checks all three in the headers you paste.

Are my headers uploaded anywhere?

No. Headers can contain names, addresses and internal server names, so the parser runs entirely in your browser. Nothing you paste reaches RocketVerifier or any other server.

Keep going

More free email tools

Authentication set? Now clean the list.

Passing SPF, DKIM and DMARC protects your domain. Verifying your list keeps hard bounces from wearing down the reputation those checks build.

Start free Bulk verification

100 free credits · No card required · Credits never expire