How to Analyze Email Headers
Raw email headers contain routing and authentication evidence added as a message moves between systems. Reading them carefully can reveal sending infrastructure, authentication results, transport details and mail-hop timing.
Received headers
Mail servers add Received fields as a message moves through the delivery path. These fields can contain hostnames, IP addresses, timestamps and protocol information.
They are normally interpreted as a chain, with attention to which systems added each field and which portions can be trusted.
Authentication-Results
Authentication-Results fields can record SPF, DKIM and DMARC outcomes calculated by a receiving system.
The context matters because authentication results describe a particular receiver's evaluation of the message at that point in delivery.
DKIM and ARC
DKIM-Signature contains the signing domain, selector and signature metadata. ARC can preserve authentication information across intermediaries such as forwarding systems.
An analyzer can extract these structures, but authentication interpretation should consider the complete message path.
TLS and routing evidence
Received headers can sometimes expose ESMTPS, TLS versions or cipher information. Differences between timestamps can also help reveal delays between hops.
Header evidence describes the observed message and should not automatically be generalized to every message sent by the same domain.
Free email diagnostics
FreeMailCheck provides free tools for SPF, DKIM, DMARC, DNS, SMTP, TLS, reverse DNS, email headers and sender compliance.
Browse all 61 tools →