Email header analyzer

Every email carries a block of headers above the part you read: who sent it, the servers it passed through, and the results of the checks the receiving server ran. Mail clients hide them, and each one has a way to show them.

In Gmail, open the message, click More next to Reply, then Show original, and use Copy to clipboard. In the new Outlook and Outlook on the web, open the message's More actions menu and choose View, then View message details. In classic Outlook for Windows, open the message in its own window and choose File, then Properties: the headers are in the Internet headers box. In Apple Mail, choose View, then Message, then All Headers. Paste what you copied above. A whole message works too, because only the headers at the top are read.

Each server that handles a message adds a Received header on top of the ones before it, saying which server it took the message from, when, and how. Read from the bottom up, they trace the message from the sender's server to the recipient's mailbox. The analyzer puts them in that order and numbers each hop.

The delay at a hop is the time between its timestamp and the one before, and the first hop is measured from the Date header the sender wrote. A second or two per hop is normal. Minutes at one hop usually mean the message waited there: in a sending service's queue, in a filter's scan, or because the receiving server turned the first attempt away to see whether the sender would try again, which is called greylisting. A negative delay means the two servers' clocks disagree.

The receiving server records what it checked in an Authentication-Results header. spf= says whether the sending server was allowed to send for the envelope domain, the one in the Return-Path. dkim= says whether a signature verified, and for which domain. dmarc= says whether one of the two passed for a domain that belongs to the address in From, the one a reader sees.

That last part is why mail can pass SPF and DKIM and still fail DMARC: a sending service that uses its own domain for the envelope and the signature authenticates its own name, not yours. The analyzer says which domain each check passed for, and links each one to the checker that shows the record behind it.

Headers hold email addresses, server names and IP addresses, so this tool reads them in your browser and nowhere else. Nothing you paste is sent to SendHeron or anyone else, stored, or put in the page's address. Once the page has loaded, it works without a connection.