Where do I find the headers of an email?
Headers sit in front of the visible text of every email and record which server accepted the message, when and from whom. Every mail client can show them, only in a different place.
- Gmail: open the message, menu (three dots) → “Show original”, then copy the text from “Delivered-To:” onwards.
- Outlook (web): open the message, menu → “View” → “View message details”.
- Outlook (desktop): open the message in its own window, File → Properties → “Internet headers”.
- Apple Mail: View → Message → “All headers”.
- Thunderbird: select the message and press Ctrl+U (view source).
What the analysis answers
The three checks that decide delivery and authenticity are written into the Authentication-Results header by the receiving server.
- SPF: was the server that delivered the mail allowed to send for the sender domain?
- DKIM: is the cryptographic signature valid, so the message was not altered in transit?
- DMARC: does the checked domain match the visible sender address (alignment)? A message can pass SPF and still be forged if the passing domain differs from the one in the From field.
- Route: every hop from the Received lines with time, waiting time and whether the handover was encrypted (ESMTPS).
- Spam filter: score and threshold from SpamAssassin, or the Microsoft 365 value, as far as the recipient writes them into the headers.
Why does my mail land in spam?
The most common cause is missing alignment: a newsletter or CRM service sends with its own return path, SPF passes for that service’s domain, but the From field shows your own domain. DMARC fails although SPF reports “pass”. The fix is to let the service sign with your domain (DKIM) or to set up a dedicated sending domain. The second most common cause is a DKIM failure after forwarding: automatic forwarders often modify the message and break the signature.
Are the headers stored?
No. The analysis runs in the server’s memory, the result is delivered to your browser only and is neither cached nor logged. The lookup log keeps just the sender domain so we can see how busy the tools are – no addresses, no subject, no internal host names.
Frequently asked questions
- Do I need the whole message?
- No, the headers are enough: everything before the first empty line. Pasting the full source works too – the body is discarded and never evaluated.
- Why do SPF, DKIM and DMARC show “no result”?
- Then the receiving server wrote no Authentication-Results line, which happens with internal mailboxes and at some hosters. The analysis falls back to Received-SPF and the DKIM signature, which only show what the sending server claimed.
- Can I tell whether a mail is forged?
- The analysis shows what the recipient checked. If SPF or DKIM pass for exactly the domain in the From field and DMARC reports “pass”, the mail really comes from that domain. If that is missing or the domain differs, be careful – do not open attachments or links.
- What about ARC?
- ARC headers (Authenticated Received Chain) are added by forwarders and mailing lists. The analysis reads the recipient’s results; a valid ARC chain can explain why a message was delivered despite a broken DKIM signature.