# Email Header Analyzer: Free SPF, DKIM & DMARC Checker URL: https://notificationharbor.com/tools/email-header-analyzer Type: tool Locale: en Published: 2026-09-09 Updated: 2026-09-10 --- > Free email header analyzer: paste raw headers and see SPF, DKIM, and DMARC results plus relay hop count, parsed entirely in your browser. ## Check SPF, DKIM, and DMARC straight from raw email headers Paste the header block from any email and this email header analyzer reads what the receiving mail server already checked: SPF, DKIM, DMARC, relay hop count, and transit time between hops. ## Email header analyzer Paste the full raw header block below. Parsing and scoring run entirely in your browser, nothing is uploaded. *[Interactive widget — see the live page for the full experience]* ## What the score is actually reading ### Authentication-Results, parsed The analyzer looks for the receiving server's Authentication-Results line and reads the spf=, dkim=, and dmarc= values it already computed. It does not re-run DNS lookups itself, it trusts the mailbox provider that actually received the message and wrote that line. ### Relay hops, counted Every Received line is one hop between mail servers, read in order from bottom to top. When two or more hops carry a parseable date, the tool also estimates the transit time between the first and last hop, skipping the stat rather than guessing if a timestamp will not parse. ### Runs in your browser, not our servers Headers can carry internal hostnames, ticket numbers, and IP addresses you would rather not paste into a random web form. This one never sends the text anywhere. The regex parsing, the scoring, and the hop count all run client-side, in the tab you are reading right now. ## Questions about the header check ### Is this email header analyzer free to use? Yes. There is no signup and no request limit. The score comes from parsing header text in your browser, so there is no per-request cost to cap on our side. ### Where do I get the raw headers from an email? In Gmail, open the message and choose Show original. In Outlook, use View, then View Source, or the message details panel. In Apple Mail, use View, Message, All Headers. Copy the full block, including Authentication-Results and every Received line. ### Do you store the headers I paste here? No. The textarea is read by JavaScript running on your device. Nothing is uploaded, logged, or sent to our servers. The only network call this page makes is the anonymous page-view beacon common to every page on the site. ### Why does it say no Authentication-Results header found? Some receiving servers do not add that line, and forwarded or exported copies sometimes strip it on the way out. Check the original inbox where the message first landed, not a forwarded copy pasted from a ticket or thread. ### SPF passed but DMARC failed. What does that mean? DMARC checks alignment, not just a pass on SPF and DKIM individually. SPF can pass on the envelope sender while the visible From domain does not match it closely enough for the domain owner's DMARC policy. A DMARC fail here usually means the From domain and the authenticated domain differ. ### Does a 100 score guarantee the sender is legitimate? No. It means the message passed the technical checks the receiving mail server already ran: the sending server was authorized for that domain, and the signature and alignment matched. It says nothing about intent. Authenticated phishing from a compromised or look-alike domain still happens. ### Why is the transit time missing or showing clock skew? Received timestamps are set by each relay's own clock, and clocks drift. If a hop's clock reads behind the one before it, or a header has no parseable date, the tool skips the number instead of showing one it cannot stand behind. ### Does relay hop count tell me anything by itself? Not much on its own. Most B2B sends cross two to four relays between the origin server and your inbox. A higher count is not automatically suspicious, but an unfamiliar hostname appearing in the chain is worth a second look against the sender's known infrastructure. ## Track the infrastructure behind your own sends This checker reads someone else's headers after the fact. Notification Harbor is for the sends you control: domain warmup, trace-level observability, and SPF, DKIM, and DMARC configured correctly from the first send, not diagnosed after a complaint. *Call to action: See how Notification Harbor works* ## FAQ ### Is this email header analyzer free to use? Yes. There is no signup and no request limit. The score comes from parsing header text in your browser, so there is no per-request cost to cap on our side. ### Where do I get the raw headers from an email? In Gmail, open the message and choose Show original. In Outlook, use View, then View Source, or the message details panel. In Apple Mail, use View, Message, All Headers. Copy the full block, including Authentication-Results and every Received line. ### Do you store the headers I paste here? No. The textarea is read by JavaScript running on your device. Nothing is uploaded, logged, or sent to our servers. The only network call this page makes is the anonymous page-view beacon common to every page on the site. ### Why does it say no Authentication-Results header found? Some receiving servers do not add that line, and forwarded or exported copies sometimes strip it on the way out. Check the original inbox where the message first landed, not a forwarded copy pasted from a ticket or thread. ### SPF passed but DMARC failed. What does that mean? DMARC checks alignment, not just a pass on SPF and DKIM individually. SPF can pass on the envelope sender while the visible From domain does not match it closely enough for the domain owner's DMARC policy. A DMARC fail here usually means the From domain and the authenticated domain differ. ### Does a 100 score guarantee the sender is legitimate? No. It means the message passed the technical checks the receiving mail server already ran: the sending server was authorized for that domain, and the signature and alignment matched. It says nothing about intent. Authenticated phishing from a compromised or look-alike domain still happens. ### Why is the transit time missing or showing clock skew? Received timestamps are set by each relay's own clock, and clocks drift. If a hop's clock reads behind the one before it, or a header has no parseable date, the tool skips the number instead of showing one it cannot stand behind. ### Does relay hop count tell me anything by itself? Not much on its own. Most B2B sends cross two to four relays between the origin server and your inbox. A higher count is not automatically suspicious, but an unfamiliar hostname appearing in the chain is worth a second look against the sender's known infrastructure.