ProbeKit
Sign inSign up

Email Header Analyzer

Email headers are the hidden lines at the top of every message that record each server it passed through and the results of its SPF, DKIM, and DMARC checks. This analyzer turns the raw headers into a timeline of hops with the delay between each one and the authentication verdicts, all in your browser.

When to use this: A message arrived late, landed in spam, or looks spoofed, and you want to see its route and authentication results.

Fully client-side — headers never leave your browser.

How to get the full email headers

Every mail client hides the headers by default. Copy them from the message that had the problem, then paste them above.

Gmail

Gmail in a web browser

  1. Open the message.
  2. Select the More menu (three vertical dots) next to Reply, at the top right of the message.
  3. Choose Show original. The full headers open in a new tab.
  4. Select Copy to clipboard and paste the text into the box above.

The Gmail apps for phones and tablets do not offer Show original, so use a browser on a computer.

Outlook

Outlook on the web, Outlook.com, and the new Outlook for Windows

  1. Open the message.
  2. Select More actions (three dots) at the top right of the message.
  3. Choose View, then View message details. Some versions call it View message source.
  4. Select all of the text, copy it, and paste it into the box above.

Classic Outlook for Windows

  1. Double-click the message to open it in its own window.
  2. Select File, then Properties.
  3. The headers are in the Internet headers box at the bottom. Click in it, press Ctrl+A, then Ctrl+C.

Outlook for Mac

  1. Control-click (right-click) the message in the list.
  2. Choose View Source, then copy the header lines at the top.

Menu names can differ between Outlook versions and updates; look for "message details" or "source".

Apple Mail

Mail on a Mac

  1. Select the message.
  2. Choose View, then Message, then All Headers to show every header above the message, or Raw Source (Option-Command-U) to open the full source.
  3. Copy the header lines (everything above the first blank line) and paste them into the box above.

Mail on iPhone and iPad cannot show headers. Forward the message as an attachment to a Mac or a webmail account and copy them there.

Other clients usually call it View source, Show original, or Message source. Copy everything above the first blank line.

What the analyzer shows

The delivery path
Every Received line becomes a hop, from the sending server to your mailbox, with the server names and the protocol used at each step.
Where the delay happened
The time between consecutive hops, with any hop slower than a minute highlighted, and the total time from send to delivery.
SPF, DKIM, and DMARC verdicts
The pass or fail results your mail server recorded in Authentication-Results, with the domain each check used.
The message identity
From, To, Subject, Date, and Message-ID, so you can match the headers to the message and quote the ID to a provider.

Have a bounce instead of a delivered message? Paste it into Diagnose an Error or look the code up in the bounce code reference.

About the Email Header Analyzer

Paste the raw headers of any email to see the route it took as a timeline, how long each server held it, and the SPF, DKIM, and DMARC verdicts your mail server recorded. Parsing runs entirely in your browser, so the headers are never uploaded.

FAQ

What is an email header?
The block of lines above the message body that mail software adds as a message travels: one Received line per server, the Authentication-Results of SPF, DKIM, and DMARC, and fields such as From, Date, and Message-ID. Mail clients hide it by default.
How do I find the raw headers?
In Gmail, use More (three dots), then Show original. In Outlook on the web or the new Outlook, use More actions, then View, then View message details. In classic Outlook for Windows, open the message and use File, then Properties, then Internet headers. In Apple Mail on a Mac, use View, then Message, then All Headers or Raw Source. Menu names vary a little between versions.
Which hop caused the delay?
Look for the largest gap between consecutive Received timestamps. The timeline shows the delay added at each hop and highlights any hop that took more than a minute.
Why does the message say SPF or DKIM failed when my records look right?
Headers show the verdict at the moment of delivery. Forwarding, mailing lists, and security gateways that rewrite messages often break SPF or DKIM in transit, and a record changed after the message was sent will not change an old verdict.
Can headers be forged?
Lines added before a message reached your provider can be faked by the sender. Trust the Received lines and Authentication-Results added by your own mail servers, which are the ones nearest the top.
Are my headers uploaded or stored?
No. The analyzer runs in your browser and nothing you paste is sent to ProbeKit.