Analysis of email headers

HomeToolsAnalysis of email headers

Understanding email headers

The Received fields record the path through mail servers, while Authentication-Results reports SPF, DKIM and DMARC assessments by a receiving server. Return-Path can differ from the visible From address.

How to investigate

Export the original complete message headers without editing their order.
Identify trusted receiving servers and their authentication results.
Check domain alignment between SPF or DKIM and the From domain when interpreting DMARC.

FAQ

Does SPF pass prove the visible sender? No. SPF checks the envelope domain, not necessarily the visible From address.

Can every Received header be trusted? No. Untrusted upstream headers can be forged.

Practical example: interpret an email header

Paste a fictional example

Paste the sample below into the full-headers field. Analysis should extract test@example.com, the subject BAOI demonstration, the PASS values and one Received hop. These values describe the supplied text; they do not establish that a message is authentic.

From: test@example.com
To: recipient@example.net
Subject: BAOI demonstration
Received: from mail.example.com by mx.example.net; Sun, 25 Oct 2026 12:00:00 +0000
Authentication-Results: mx.example.net; spf=pass; dkim=pass; dmarc=pass

What the results mean

This analyzer extracts fields and authentication results already present in the header. It does not repeat DKIM cryptographic verification or perform a live SPF evaluation. Missing fields are shown as unspecified. For an investigation, identify the trusted receiving server before interpreting Authentication-Results, and compare From, Reply-To and Return-Path.

Keep a useful investigation record

Use complete headers from the email service and preserve the order of their lines.
Compare the output with the receiving service’s logs or message trace where available.
Keep a copy suitable for the report’s audience; real headers can contain addresses and IPs. This analyzer processes the supplied text locally.

Technical references: RFC 8601 — Authentication-Results