Email header analyser

How do you copy the headers?

Each mail program keeps them in a different place.

Outlook for Windows

Open the message in its own window, choose File, then Properties, and copy everything in the Internet headers box.

Outlook on the web and the new Outlook

Open the message, choose the three dots, then View, then View message details, and copy the text.

Gmail

Open the message, choose the three dots next to Reply, then Show original, and copy the text from the top down to the first empty line.

Apple Mail

Select the message, choose View, then Message, then All Headers, and copy them.

What does it show?

Four groups. The sender, authentication and spam lines are marked OK, Weak, Missing or Can't see; the hops are listed in order.

Sender

The From address, the return path for bounced messages, and any Reply-To address on another domain. A Reply-To on another domain is a common sign of fraud.

Authentication

The SPF, DKIM and DMARC results the receiving server recorded, and Microsoft's combined verdict when it is there.

Spam verdicts

What Microsoft's filters decided and why. The spam confidence level is shown too, but in Microsoft 365 it no longer decides the verdict: the category and verdict do.

Hops

Each server the message passed through, oldest first, with how long each step took.

What can it not see?

It reads only what the headers say. It cannot check a signature itself or see whether the sending server was listed in SPF at the time. If the message was forwarded, the last server's results can differ from the first.

When the headers do not say, it shows Can't see rather than guess. It is a first look, not a forensic report.

Are the headers sent to you?

No. The analyser reads them in your browser and makes no request at all. It stores nothing and sends nothing to us. Nothing reaches us unless you write to us through the contact form.