Free forever
Email HeaderAnalyzer
Paste raw email headers to visualize the delivery path, analyze authentication results, and identify delays. The Authentication-Results line is the receiving server’s own verdict, and it is the only one that decides anything.
14-day free trial · no credit card · cancel anytime
Every email carries a receipt of its own journey: the headers. They record each server that touched the message (the Received chain), the exact times, the sending IP, and the authentication verdicts the receiving server computed for SPF, DKIM and DMARC.
The line that settles arguments is Authentication-Results. It is written by the receiving server about the message it actually accepted, which makes it the closest thing to ground truth you can get without asking the receiver.
How it works
- 01Copy the full raw headers from the bounced or spam-filed message. In Gmail that is Show original, in Outlook View message source; you need everything, not just the From line.
- 02The analyzer parses the Received chain in order, showing each hop, the delays between hops, and the originating IP where the chain starts.
- 03Authentication results are extracted per mechanism: which domain SPF evaluated, which DKIM selector and domain signed, and the DMARC verdict that combines them.
- 04Delays and hop counts surface immediately, so you can tell a slow sender-side handoff from a slow receiving queue.
When to use it
A recipient says your mail went to spam or never arrived, and you need to see authentication as the receiver saw it, not as your dashboard claims it.
You are chasing delivery delays and want to know where in the chain the minutes went.
Common mistakes
Reading the Received chain top-down
Each server prepends its Received line, so the newest hop is at the top and the true origin is at the bottom. Read it bottom-up or you will blame the last hop for what the first one did.
Trusting the From header
The From address is what the sender typed and is trivially forged. The domains that matter for authentication are the envelope From (Return-Path) for SPF and the DKIM signing domain for DKIM. Only DMARC ties those to the visible From.
Reading an intermediate Authentication-Results
Mailing lists and forwarders add their own verdict lines. The only Authentication-Results that decided the folder placement is the one written by the final receiving server, which is the last one added.
Missing the alignment mismatch
SPF can pass and DKIM can pass and DMARC can still fail, because DMARC requires one of them to align with the visible From domain. Headers show you all three lines; the analyzer highlights the mismatch instead of leaving it to squinting.
Frequently asked questions
What is the Received header and why are there many?
Every server that relays a message adds a Received line on top. The full stack is the delivery path in reverse order, with timestamps and the IP each server received it from. The bottom line describes the first hop, which is usually your sending server.
What does Authentication-Results mean?
It is the receiving server writing down the SPF, DKIM and DMARC verdicts it computed, per domain and selector. Unlike your own tests, it reflects the real message at the real receiver, which is why support teams ask for it.
Why does SPF pass but DMARC fail?
DMARC needs SPF or DKIM to pass AND the passing domain to match the visible From domain (alignment). Mail sent through a provider from a different envelope domain passes SPF but fails alignment, so DMARC fails unless DKIM signs with the right domain.
How do I find the sending IP from headers?
Walk the Received chain to the bottom entry: the IP in it is where the message entered the mail system, which is the IP your provider actually sent from. That is the IP to check against blocklists.
Can headers tell me why Gmail put my message in spam?
Partly. Headers confirm authentication verdicts, delays and the path; they cannot show Gmail internal filtering reasons. Clean authentication plus a sane path rules out the causes you can fix, which is the necessary first step.
What is Return-Path and how is it different from From?
Return-Path is the envelope sender, the address bounces go back to, and the domain SPF evaluates. From is the display address people see. When the two differ, SPF passes cannot align for DMARC, which is common when sending through a provider with its own bounce domain.
From the blog
- 550 5.7.515 in Outlook: What It Means and How to Fix It?Outlook.com bounced the email because the From domain failed a trust check. The May 2025 rule, the 5,000-a-day line, and the DNS fix.
- Why Does My Email Fail DMARC When SPF Passes?SPF checked the domain your platform mailed from, not the domain in your From line. That mismatch, not a broken record, is the usual reason DMARC fails.
Related free tools
These tools answer the question once. Continuous monitoring re-checks your domain every 6 hours and alerts you when the answer changes, from $14/mo. Pricing · Guides · FAQ
This answers once. Monitoring answers every 6 hours.
LitInboxes re-checks DNS, DMARC, and blocklists on a schedule and emails you when the answer changes. Start with a 14-day free trial.
14-day free trial · no credit card · cancel anytime