Where do I find the headers of an email?
Headers sit in front of the visible text of every email and record which server accepted the message, when and from whom. Every mail client can show them, only in a different place.
- Gmail: open the message, menu (three dots) → “Show original”, then copy the text from “Delivered-To:” onwards.
- Outlook (web): open the message, menu → “View” → “View message details”.
- Outlook (desktop): open the message in its own window, File → Properties → “Internet headers”.
- Apple Mail: View → Message → “All headers”.
- Thunderbird: select the message and press Ctrl+U (view source).
What the analysis answers
The three checks that decide delivery and authenticity are written into the Authentication-Results header by the receiving server.
- SPF: was the server that delivered the mail allowed to send for the sender domain?
- DKIM: is the cryptographic signature valid, so the message was not altered in transit?
- DMARC: does the checked domain match the visible sender address (alignment)? A message can pass SPF and still be forged if the passing domain differs from the one in the From field.
- Route: every hop from the Received lines with time, waiting time and whether the handover was encrypted (ESMTPS).
- Spam filter: score and threshold from SpamAssassin, or the Microsoft 365 value, as far as the recipient writes them into the headers.
Why does my mail land in spam?
The most common cause is missing alignment: a newsletter or CRM service sends with its own return path, SPF passes for that service’s domain, but the From field shows your own domain. DMARC fails although SPF reports “pass”. The fix is to let the service sign with your domain (DKIM) or to set up a dedicated sending domain. The second most common cause is a DKIM failure after forwarding: automatic forwarders often modify the message and break the signature.
Are the headers stored?
No. The analysis runs in the server’s memory, the result is delivered to your browser only and is neither cached nor logged. The lookup log keeps just the sender domain so we can see how busy the tools are – no addresses, no subject, no internal host names.