Email header analyser

Paste the raw headers from a message. You get the authentication verdicts, the alignment check that actually decides whether DMARC passes, and the delivery path with the delay at each hop.

Runs entirely in your browser — nothing is uploaded

What alignment means, and why it is the whole game

SPF authenticates the hidden envelope sender. DKIM authenticates whichever domain signed the message. Neither is necessarily the From: address your recipient reads — and forging that visible address is the entire point of a phishing email.

DMARC closes the gap by demanding alignment: one of SPF or DKIM must pass for a domain matching the From: domain. This is why SPF can pass while DMARC fails — SPF genuinely passed, just for your sending platform's bounce domain rather than yours. The table above shows both mechanisms side by side with their alignment, so the cause is visible immediately.

Reading the delivery path

Received: headers are prepended by each server, so the newest is at the top. The table reverses them into real chronological order and shows the gap between hops. A single hop taking tens of seconds usually means greylisting or a queue backing up at the receiver, not a problem with your DNS.

Then check the domain itself

Headers tell you what happened to one message. To see whether the records are right in the first place, check the domain.