Summary

This email header analyzer reads the raw header block from any email and reports whether SPF, DKIM, and DMARC actually passed, based on the Authentication-Results line the receiving mail server already computed. It also counts relay hops from the Received lines and estimates transit time between them when the timestamps allow it. Paste headers from Gmail's Show original, Outlook's view source, or Apple Mail's All Headers view. Nothing is uploaded, the parsing runs in your browser, and there is no signup required.

Check SPF, DKIM, and DMARC straight from raw email headers

Paste the header block from any email and this email header analyzer reads what the receiving mail server already checked: SPF, DKIM, DMARC, relay hop count, and transit time between hops.

Analyze your headers

Email header analyzer

Paste the full raw header block below. Parsing and scoring run entirely in your browser, nothing is uploaded.

Paste the raw header block from an email (View source, Show original, or Message details). The check runs in your browser only.

-
Paste headers above to see the breakdown
SPF, DKIM, and DMARC are read from the Authentication-Results line.
    How it works

    What the score is actually reading

    Authentication-Results, parsed

    The analyzer looks for the receiving server's Authentication-Results line and reads the spf=, dkim=, and dmarc= values it already computed. It does not re-run DNS lookups itself, it trusts the mailbox provider that actually received the message and wrote that line.

    Relay hops, counted

    Every Received line is one hop between mail servers, read in order from bottom to top. When two or more hops carry a parseable date, the tool also estimates the transit time between the first and last hop, skipping the stat rather than guessing if a timestamp will not parse.

    Runs in your browser, not our servers

    Headers can carry internal hostnames, ticket numbers, and IP addresses you would rather not paste into a random web form. This one never sends the text anywhere. The regex parsing, the scoring, and the hop count all run client-side, in the tab you are reading right now.

    Questions about the header check

    Is this email header analyzer free to use?
    Yes. There is no signup and no request limit. The score comes from parsing header text in your browser, so there is no per-request cost to cap on our side.
    Where do I get the raw headers from an email?
    In Gmail, open the message and choose Show original. In Outlook, use View, then View Source, or the message details panel. In Apple Mail, use View, Message, All Headers. Copy the full block, including Authentication-Results and every Received line.
    Do you store the headers I paste here?
    No. The textarea is read by JavaScript running on your device. Nothing is uploaded, logged, or sent to our servers. The only network call this page makes is the anonymous page-view beacon common to every page on the site.
    Why does it say no Authentication-Results header found?
    Some receiving servers do not add that line, and forwarded or exported copies sometimes strip it on the way out. Check the original inbox where the message first landed, not a forwarded copy pasted from a ticket or thread.
    SPF passed but DMARC failed. What does that mean?
    DMARC checks alignment, not just a pass on SPF and DKIM individually. SPF can pass on the envelope sender while the visible From domain does not match it closely enough for the domain owner's DMARC policy. A DMARC fail here usually means the From domain and the authenticated domain differ.
    Does a 100 score guarantee the sender is legitimate?
    No. It means the message passed the technical checks the receiving mail server already ran: the sending server was authorized for that domain, and the signature and alignment matched. It says nothing about intent. Authenticated phishing from a compromised or look-alike domain still happens.
    Why is the transit time missing or showing clock skew?
    Received timestamps are set by each relay's own clock, and clocks drift. If a hop's clock reads behind the one before it, or a header has no parseable date, the tool skips the number instead of showing one it cannot stand behind.
    Does relay hop count tell me anything by itself?
    Not much on its own. Most B2B sends cross two to four relays between the origin server and your inbox. A higher count is not automatically suspicious, but an unfamiliar hostname appearing in the chain is worth a second look against the sender's known infrastructure.

    Track the infrastructure behind your own sends

    This checker reads someone else's headers after the fact. Notification Harbor is for the sends you control: domain warmup, trace-level observability, and SPF, DKIM, and DMARC configured correctly from the first send, not diagnosed after a complaint.

    See how Notification Harbor works
    notificationharbor
    Start free