FREE TOOL BY WARMY.IO

Email Header Analyzer

Q: Is Warmy’s email header analyzer free?

Yes. It’s a free email header analyzer with no sign-up.

Q: Is my header data safe?

Yes. The header is analyzed entirely in your browser. Nothing is uploaded, saved or shared.

Q: Can I upload an .eml file instead of pasting the header?

Yes. Click Import .eml and the analyzer reads the header from the file. The file stays on your device.

Q: Can email headers be faked?

Partly. A sender can fake the From address and add made-up Received lines before the email reaches your provider. The lines your own provider added, including Authentication-Results, are the ones to trust.

Q: Can an email header show if an email is phishing?

It can show warning signs: failed authentication, a Reply-To on a different domain, a lookalike sender domain or an unusual route. It can’t prove an email is safe, so never click links in a suspicious message.

Q: What do “mailed-by” and “signed-by” mean in Gmail?

They’re a short version of the header. Mailed-by shows the Return-Path domain that SPF checked, and signed-by shows the domain in the DKIM signature. If neither matches the From domain, DMARC alignment is likely to fail.

Q: Why does my email have more than one DKIM signature?

It’s common when you send through an ESP. The ESP signs with its own domain and, if you set it up, also with yours. For DMARC, the signature that counts is the one from your From domain.

Q: Does it work with Outlook, Apple Mail and Yahoo headers?

Yes. Email headers follow the same standard, so the analyzer reads headers from Gmail, Outlook, Apple Mail, Yahoo Mail and any other client.

Q: How often should I check my email headers?

Check one whenever something changes: a new domain or ESP, a DNS update, or a sudden drop in opens. For ongoing monitoring, Warmy tracks your authentication and inbox placement automatically.

Paste any email header and get a free, plain-English breakdown: SPF, DKIM and DMARC results, every server the message passed through, delays, and the red flags spam filters look at.

SPF, DKIM & DMARC
Routing & delays
No sign-up needed
Runs in your browser

How to Find the Full Email Header

Every inbox hides the header by default. Here’s where to find it. Open the email on a computer: most mobile apps don’t show full headers.

Gmail

Gmail’s official instructions ↗

Your October update

Y

Your Brand

Hi Jane,
Here’s your monthly update.

Step 1 of 3 · illustrative example

How it works

How to Analyze Email Headers in 4 Steps

Read any email like a deliverability expert.

To analyze an email header, copy the full header from your inbox (Show original in Gmail, View message details in Outlook), paste it into Warmy’s email header analyzer and click Analyze header. In a few seconds you’ll see whether SPF, DKIM and DMARC passed, how long each server held the message, and which issues need fixing.

Copy the Header
Use Show original, View message details or View raw message in your inbox and copy the full header, or import the email as an .eml file.
Check Authentication
See at a glance whether SPF, DKIM and DMARC passed or failed.
Follow the Route
Trace every server the email passed through, with the time spent at each hop, so slow relays stand out.
Spot the Red Flags
Get plain-English warnings for failed checks and slow hops.

Get started

Found the Problem?
Let Warmy Help Your Emails Reach the Inbox

A header shows you the symptoms: a failed check, a slow hop, a missing signature. Warmy works on the causes, so the next email has a better shot at the inbox.

Fix authentication for good.

DMARC monitoring shows every service sending as your domain and what fails.

Build sender reputation.

Email warm-up sends and engages with your emails across a network of 1M+ real inboxes.

Check placement before you send.

The inbox placement test shows Inbox, Promotions or Spam at Gmail, Outlook and Yahoo.

Start Free Trial Book a Demo

No Credit Card Required | Cancel Anytime

4.9/5 on G2

Recognized by the People Who Use Us

Award-winning on G2, season after season. Trusted by 35,000+ happy businesses: marketers, entrepreneurs, and affiliates.

A white and teal triangle with black text.

What Is an Email Header Analyzer?

An email header analyzer is a tool that turns the raw technical header of an email into a readable report: who really sent it, which servers handled it and when, and whether it passed SPF, DKIM and DMARC. You may also see it called a message header analyzer, an email header parser or simply a header analyzer. They all do the same job.

Reading a header by hand is possible but slow. A single message can carry 50+ lines of Received, Authentication-Results and DKIM-Signature data, written in reverse order. Email header analysis with a tool takes seconds and highlights the lines that matter for delivery, including the MX and SMTP hops most people never look at. Think of it as an email header checker that explains what it finds, not just a parser that reformats the text.

New to headers? Read our guide: Everything You Need to Know About Email Headers.

What Can an Email Header Tell You?

An email header records the sender and recipient, the subject and date, a unique Message-ID, every server that relayed the message (with timestamps) and the authentication results the receiving server recorded. For deliverability, these are the fields worth reading first:

Authentication-Results

The receiving server’s verdict on SPF, DKIM and DMARC

Red flag

Any fail, softfail or none on a domain you control

Received

Each server the email passed through, with a timestamp

Red flag

Long gaps between hops, unexpected relays

Return-Path

The envelope sender (bounce address) that SPF checks

Red flag

Domain unrelated to your From domain (breaks SPF alignment)

From / Reply-To

The sender the recipient sees, and where replies go

Red flag

Reply-To on a different, unknown domain

DKIM-Signature

Which domain (d=) signed the message, with which selector (s=)

Red flag

Only your ESP’s domain signs, not yours (breaks DKIM alignment)

ARC-Seal / ARC-Message-Signature

Authentication results preserved through forwarding

Red flag

Forwarded mail failing DMARC without ARC

List-Unsubscribe / List-Unsubscribe-Post

Whether one-click unsubscribe is set up

Red flag

Missing on bulk marketing email

Message-ID

The unique ID the sending system gave the email

Red flag

Missing or malformed ID

How to Read SPF, DKIM and DMARC Results in an Email Header

Look for the Authentication-Results line added by your receiving server. It’s a quick SPF, DKIM and DMARC check in one place: each protocol gets a result word, and the line shows which domain was checked. For DMARC to pass, at least one of SPF or DKIM has to pass and align with the From domain; Gmail still requires bulk senders to set up both.

How to Read SPF, DKIM and DMARC Results in an Email Header
Result	What it means	What to do
`pass`	The check succeeded for the domain shown	Nothing, as long as it’s your domain
`fail`	SPF: the sending IP isn’t authorized (-all). DKIM: the signature doesn’t verify, e.g. the message was changed or the key doesn’t match. DMARC: neither SPF nor DKIM passed in alignment with the From domain	Fix the record or signing setup for that sender
`softfail` (SPF)	The domain’s SPF ends in ~all and the IP isn’t listed	Add the sending service to your SPF record
`neutral` (SPF)	The domain makes no claim about this IP (?all)	Publish a real SPF policy
`none`	SPF: no SPF record, or the domain couldn’t be checked. DKIM: the message wasn’t signed. DMARC: no DMARC policy found	Publish the missing record or enable DKIM signing
`temperror`	A temporary error during the check, usually a DNS timeout	Usually temporary; if it keeps appearing, check your DNS hosting
`permerror`	The record is broken, e.g. SPF over 10 DNS lookups or a syntax error	Fix the record; flatten SPF if needed

In Warmy’s analyzer, each check appears as Pass, Did not pass or Not found. To see the exact result word, such as softfail or permerror, open the All headers tab.

Fix tools: SPF Generator, SPF Checker & Flattener, DKIM Generator & Checker, DMARC Checker.

Why DKIM Can Pass While DMARC Fails

DMARC doesn’t just ask whether SPF or DKIM passed. It asks whether they passed for the same domain as the From address. That’s called alignment. If your ESP signs with its own domain (d=esp-example.net) and uses its own bounce domain, both checks pass, yet DMARC fails because neither matches yours. The fix is to set up DKIM signing and a custom return-path on your own domain in your ESP’s settings.

Email Header Example, Explained

Here’s a shortened header from a marketing email that passed every check. Received lines are read from the bottom up: the lowest one is the earliest hop. mx.example.com is the recipient’s provider; everything below its Received line was written by the sender’s systems.

Delivered-To: jane@example.com
Received: from mail.example.org (mail.example.org [203.0.113.25])
        by mx.example.com with ESMTPS id 4f7c9a
        for <jane@example.com>; Tue, 14 Oct 2025 09:12:07 +0000
Received: from app01.internal.example.org (app01 [10.0.0.12])
        by mail.example.org with ESMTP id 82b1d0;
        Tue, 14 Oct 2025 09:12:05 +0000
Authentication-Results: mx.example.com;
        spf=pass smtp.mailfrom=bounce.example.org;
        dkim=pass header.d=example.org header.s=s1;
        dmarc=pass (p=quarantine) header.from=example.org
Return-Path: <bounce@bounce.example.org>
DKIM-Signature: v=1; a=rsa-sha256; d=example.org; s=s1; ...
From: Alex at Example <alex@example.org>
To: jane@example.com
Subject: Your October update
Date: Tue, 14 Oct 2025 09:12:04 +0000
Message-ID: <a1b2c3@example.org>
List-Unsubscribe: <https://example.org/unsub?id=123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Bottom Received line: The sender’s internal app server (10.0.0.12, a private address) passed the email to their outbound mail server at 09:12:05. Written by the sender’s systems
Top Received line: Written by the recipient’s provider (mx.example.com): it accepted the email from mail.example.org at 203.0.113.25 at 09:12:07, 2 seconds end to end. 203.0.113.25 is the sending server IP
spf=pass smtp.mailfrom=bounce.example.org: SPF passed for the bounce subdomain, which aligns with example.org under relaxed alignment
dkim=pass header.d=example.org: The message was signed by the sender’s own domain
dmarc=pass (p=quarantine): DMARC passed; the domain’s policy would quarantine failing mail
List-Unsubscribe-Post: One-click unsubscribe is set up, which Gmail and Yahoo expect from bulk senders

Why Was My Email Delayed? Reading Hops and Timestamps

Every server that handles an email adds a Received line with a timestamp. The analyzer compares neighbouring timestamps to show how long each hop held the message, and flags hops that took unusually long. A delay of a few seconds is normal; minutes or hours point to a problem.

Greylisting: The receiving server refused the first attempt from an unfamiliar sender; the email arrives minutes later after a retry
Throttling / rate limits: Long gaps on the sender’s side, common on new domains and IPs or when sending too fast
Spam and security scanning: Extra hops through filtering services, each adding seconds to minutes
Queues on overloaded servers: A long gap at one specific relay
Wrong server clock: Odd or even negative delays: the timestamps themselves are wrong

How to Find the IP Address an Email Was Sent From

To find the sending server’s IP address, look for the Received line added by your own email provider, the topmost one written by a server you trust. The IP in its “from” part is the server that handed the email over. In the example above that’s 203.0.113.25.

Lines below that one were written by the sender’s systems or by servers along the way, and they can be faked. And this is the sending server, not the person: if someone writes from Gmail or Outlook.com, you’ll usually see the provider’s server rather than their device, so a header rarely tells you where someone physically is.

Want to know if a sending IP or domain is on a blocklist? Run it through the Blacklist Checker.

Authentication Passes, but Emails Still Land in Spam?

SPF, DKIM and DMARC help receiving mail servers verify whether a message is authorized to use a domain and whether authentication aligns with the visible From address. Passing these checks doesn’t guarantee inbox placement or prove that a message is trustworthy.

Inbox providers also weigh your domain and IP reputation, how recipients engage (opens, replies, “not spam” clicks, complaints), how much and how fast you send, and the content itself. A brand-new domain with perfect authentication can still go to spam simply because it has no sending history yet.

That’s the gap Warmy fills: warm-up builds reputation with real engagement, and the inbox placement test shows where your emails actually land.

What Gmail, Yahoo and Microsoft Require From Senders

What Gmail, Yahoo and Microsoft Require From Senders
Mailbox provider	Since	Who it applies to	Key requirements
Gmail	February 2024	All senders; extra rules for 5,000+ messages a day to Gmail accounts	SPF or DKIM for all; SPF, DKIM and DMARC with alignment, one-click unsubscribe and a spam rate below 0.3% for bulk senders
Yahoo	February 2024	All senders; extra rules for bulk senders	SPF and DKIM, DMARC for bulk senders, one-click unsubscribe, low complaint rate
Outlook.com (Microsoft)	May 2025	Domains sending 5,000+ messages a day to Outlook.com, Hotmail and Live addresses	SPF, DKIM and DMARC (at least p=none, aligned)

Full breakdown: Google & Yahoo Sender Requirements.

FAQ