Free tool
Paste a message's headers and read what the receiving server actually decided: the SPF, DKIM and DMARC results it recorded, whether they align with the domain in From, and where the message spent its time on the way.
Every server that handles a message adds to the top of it. By the time it reaches an inbox, the headers hold a complete record of where it came from, who checked what, and what they concluded — and none of it is visible in a mail client.
Authentication-Results — the receiving provider's own verdict on SPF, DKIM and DMARC for this message. Not what your DNS says: what Gmail or Microsoft decided. Received — one per hop, newest first, each with a timestamp. Read bottom to top and the gaps are the delays. Return-Path — the envelope sender, which is what SPF is checked against and is regularly a different domain from the one in From. DKIM-Signature — the signing domain (d=) and selector (s=), which is also how you find your own selector for the DKIM checker. A message can pass SPF and DKIM and still fail DMARC, and it happens constantly. DMARC compares the domain that passed against the domain the reader sees in From: an ESP that signs with its own domain and bounces to its own domain has authenticated itself perfectly and told the receiver nothing about you.
This analyzer does that comparison explicitly and names both domains, so the fix — sign with your domain, or bounce to a subdomain of it — is obvious rather than deduced.
s= tag and look the key up with the DKIM checker. Gmail: open the message, ⋮ → Show original. Outlook: File → Properties → Internet headers. Apple Mail: View → Message → All Headers. Thunderbird: Ctrl+U. Take them from the message as it was delivered — a copy from your Sent folder has never been through a receiving server and carries no verdict.
The headers are posted to our API, parsed in that request and dropped. Nothing is stored, nothing is cached, and the log line records how many hops and findings there were, never the content. The message body is not read at all — if you paste a whole message, everything after the first blank line is ignored.
Alignment. DMARC does not ask whether SPF or DKIM passed, but whether the domain that passed is the domain in From. A sending platform that signs with its own domain, or bounces to its own domain, passes both checks and aligns with neither. The analyzer compares them for you and says which one is off.
Each Received header carries the time that hop handled the message, so the gaps between them are where the time went. A gap of minutes is usually greylisting — the receiver deliberately deferring a first-time sender — or a queue. Gaps of hours mean retries.
Then the copy you pasted was not written by a receiving server that checks authentication, or the header was stripped. Everything else — the path, the identities, the unsubscribe headers — still reads, but no SPF/DKIM/DMARC verdict can be shown, and the analyzer says so rather than guessing one.