Free email tool
Paste a message header to see where the email travelled, how long each step took, and what the receiving server decided about SPF, DKIM and DMARC.
The header is analysed in memory and is not stored or logged. No email needed.
The authentication results come from the topmost Authentication-Results header, the one the receiving server wrote, and the page names that server. Lower copies are ignored because a sender can add them. The delivery path is rebuilt from the Received lines in the order the message travelled, with the delay at each hop.
To check a domain's published records rather than one message, use the Email Security Check, the SPF Record Checker or the DMARC Checker.
Gmail: open the message, click the three dots, then Show original. Outlook on the web: three dots, View, View message source. Outlook desktop: File, Properties, Internet headers. Apple Mail: View, Message, All Headers. Copy everything from the first line down to the first blank line.
No. It is analysed in memory for this one response and is not saved, logged or sent anywhere else. The result page is marked not to be cached.
No. The SPF, DKIM and DMARC results shown are what the receiving server recorded in its Authentication-Results header, and the page names that server. Only the topmost Authentication-Results header is used, because lower ones could have been added by the sender.
A delay needs a readable timestamp on both hops. If a server's clock is behind the previous one, the time would go backwards; the page says so instead of showing a negative or made-up delay.
Replies go to a different domain than the one the message claims to be from. That is normal for help desks and mailing lists, and it is also a common trick in phishing, so it is worth a second look when you did not expect it.
Add your domain to CloudSpex to collect DMARC reports and be alerted when authentication breaks.
Start Monitoring Free