Paste the raw headers and we'll lay out the route the message took, how long each handoff cost, and what the receiving server concluded about SPF, DKIM and DMARC — the three checks that decide whether mail lands in the inbox or the spam folder.
Paste everything from the first Received: line down to the blank line before the message body. The body itself is never read — parsing stops at that blank line — so it costs nothing if you paste too much.
Every server that handles a message adds a Received: line at the top, so the raw file reads newest-first. We flip it, so the first row is where the message started and the last is where it arrived.
Handoffs are normally instant. A gap of minutes usually means greylisting — the receiving server deliberately rejecting a first attempt to see whether a real sender retries — or a queue backing up. That is the single most useful thing in a header dump when someone says “your email arrived an hour late”.
These are the receiving server's conclusions, quoted from theAuthentication-Results header. We report what it recorded — we can't re-verify a DKIM signature after the fact without the original body, and a tool that claims otherwise is guessing.
Not necessarily. Mailing lists, ticketing systems and most bulk senders legitimately send with an envelope address on their own domain while showing yours in the From line. It matters because it means SPF alignment can't carry DMARC on its own — DKIM has to. It is also exactly what a spoofed message looks like, which is why we point it out either way rather than deciding for you.
Analysing keeps nothing. The headers are parsed inside the request and the result comes straight back.
If you create a share link, we store the parsed result only — never the raw headers you pasted — behind a random, unguessable address, and delete it 72 hours later regardless. You can delete it sooner from the button on the report. The delete key is held by your browser alone, so a link is safe to forward without handing someone the ability to destroy it.
Headers contain real addresses and internal hostnames. Share links are the exception, not the default, for exactly that reason.
This page checks once, right now. A free account checks on a schedule and emails you before something expires or goes down — 25 monitors, no card needed.
We'll watch it freeAlready have an account? Go to your dashboard