Email Header Analyzers: The Ultimate Guide and 6 Tools to Use

An email header is the block of metadata that precedes the body of an email message. It contains routing information, sender and recipient addresses, timestamps, and authentication results like SPF, DKIM, and DMARC. Analyzing these headers helps you diagnose delivery problems, identify delays, and detect spam or phishing attempts. Reading headers catches one message at a time, while the account-level practices that stop a spoofed message working cover the rest.

Your email client hides most of this data by default. But when an email gets stuck, gets flagged as spam, or takes too long to arrive, the header holds the answers.

This guide explains what email headers contain and how to view them in Gmail and Outlook. It also ranks six free tools for analyzing them.

Key Insight

Email authentication standards have become stricter since 2024. Google, Yahoo, and Microsoft now require SPF, DKIM, and DMARC compliance for bulk senders. Header analysis is the fastest way to confirm your emails pass all three checks.

What Are Email Headers?

Every email has three parts. There’s an envelope used internally for routing, a header holding metadata, and a body holding what you wrote. The header is the most useful for troubleshooting.

Header lines include the sender, recipient, subject, date, routing path, and authentication results. Your email client parses these fields and displays the basics: From, To, Subject, and Date. The rest stays hidden unless you choose to view it.

Here’s a simplified example of what a full email header looks like:

Return-Path: <sender@example.com>
Received: from mail.example.com ([192.168.1.1])
  by mx.recipient.com with ESMTP id abc123;
  Mon, 10 Mar 2026 09:15:22 -0500
Authentication-Results: mx.recipient.com;
  spf=pass; dkim=pass; dmarc=pass
From: Taylor Evans <sender@example.com>
To: Jon Smith <recipient@company.com>
Subject: Business Development Meeting
Date: Mon, 10 Mar 2026 09:15:00 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii

Common Email Header Fields

Each header field serves a specific purpose. Here are the most important ones you’ll encounter during analysis.

From: The sender’s display name and email address. This field can be spoofed, which is why SPF, DKIM, and DMARC checks exist to verify it.

To: The recipient’s email address. Bcc addresses never show here. RFC 5322 defines Bcc recipients as those “whose addresses are not to be revealed to other recipients of the message.”

Date: The timestamp when the email was composed and sent.

Subject: The subject line of the email. For tips on writing better ones, see our guide on sales email subject lines that actually work.

Received: The most critical field for troubleshooting. Each server that handles the email adds a Received line with its name, IP address, and timestamp. Read these from bottom to top to trace the message’s full path. Those lines are written by the SMTP servers that relay the message, so knowing how a sending service is configured helps when reading them; Gmail’s SMTP service is the Google example, sending mail from Gmail and Google Workspace accounts through authenticated servers.

Authentication-Results: Shows pass/fail results for SPF, DKIM, and DMARC checks performed by the receiving server.

DKIM-Signature: The cryptographic signature attached by the sending domain’s mail server. Verifying this confirms the message wasn’t altered in transit.

MIME-Version: Indicates which version of the MIME standard the email uses for formatting.

Content-Type: Specifies whether the email body is plain text or HTML.

X-Spam-Status / X-Spam-Score: Spam filtering results assigned by the receiving server. Higher scores indicate a greater likelihood of being classified as spam.

Which Received Header Is the Newest, Top or Bottom?

The topmost Received header is the most recent hop, and the bottom one is the oldest. Read email headers from the bottom up to follow a message in the order it travelled.

This is the most common point of confusion in header analysis, and the standards settle it directly. RFC 5321 section 4.4 says a receiving server:

MUST insert trace (“time stamp” or “Received”) information at the beginning of the message content.

RFC 5322 section 3.6 says the same thing from the message-format side. Trace header fields “MUST NOT be reordered” and should be “prepended to the message.”

Because every server prepends instead of appending, the stack builds downward in time. The server closest to you wrote the line closest to the top.

RFC 5322 section 3.6.7 defines the trace fields themselves as “an optional Return-Path: field, and one or more Received: fields.”

How many Received headers are too many?

A high count means a mail loop. RFC 5321 section 6.3 recommends servers “use a large rejection threshold, normally at least 100 Received entries.”

Exchange is much stricter than the standard suggests. Microsoft’s MaxHopCount parameter defaults to 30, and MaxLocalHopCount defaults to 8.

One figure worth correcting: several sources give the Exchange MaxHopCount default as 60. Microsoft’s current documentation says 30.

Microsoft caps header size too. All header fields together are limited to 256 KB, and any single header to 32 KB.

Exceed it and the message bounces with “552 5.3.4 Header size exceeds fixed maximum size.” A runaway Subject line or a long forwarding chain is the usual cause.

Why Analyze Email Headers?

Header analysis answers three questions that nothing else in the message can.

• Routing. How many servers handled the message, and did it take an unexpected path?
• Delay. Which hop held the message up? The gaps between Received timestamps show it.
• Authentication. Did SPF, DKIM and DMARC pass, and which server flagged the message if they didn’t?

The third one matters most if you want to email marketing campaign results. Google defines a bulk sender as one sending close to 5,000 messages a day to personal Gmail accounts. Google requires SPF, DKIM and a DMARC record at that volume.

How to View Email Headers in Gmail

Follow these steps to view the full email header in Gmail:

1. Open Gmail and find the message you want to analyze.
2. Click the three vertical dots in the upper-right corner of the message.
3. Select “Show Original.”
4. Gmail displays a summary with SPF, DKIM, and DMARC results at the top, followed by the full raw header text below.
5. Copy the full header text and paste it into an analyzer tool.

Gmail’s “Show Original” view gives you a quick pass/fail summary for authentication. For deeper analysis of routing delays and server hops, paste the header into one of the tools listed below.

How to View Email Headers in Outlook

The path depends on which Outlook you run. Microsoft documents each client separately on its message headers page.

Outlook client	Steps Microsoft documents
New Outlook for Windows	Microsoft says to select More actions at the top of the message window, then View, then View message details.
Classic Outlook for Windows	Microsoft says to double-click the message so it opens outside the Reading Pane, then click File, then Properties. The header appears in the Internet headers box.

For classic Outlook, Microsoft’s tip is to highlight the text in that box and press Ctrl+C. Paste it into Notepad or Word to see the entire header at once.

Neither view explains anything. Outlook hands you raw text, so paste it into one of the analyzers below.

Email Header Analyzer Tools

These tools parse raw email headers into readable reports. All six are free, and all work the same way: paste your header, click analyze, and review the results.

1. Google Admin Toolbox Messageheader

Quick Summary

Google’s own email header analyzer. It identifies delivery delays, approximate delay sources, and which server may be responsible. Free, no account required.

Google Admin Toolbox Messageheader (formerly listed as G Suite Toolbox) is the best starting point for Gmail users. It visualizes server hops and highlights delays in a clean, color-coded timeline.

The tool focuses specifically on delivery timing. It shows each hop between mail servers, the time elapsed at each, and flags any hop that introduced significant delay.

Key Features:

• Color-coded delivery delay visualization showing each server hop and time elapsed
• Identifies the approximate source (server) responsible for delays
• Part of Google’s broader Admin Toolbox, which includes DNS, MX, and log analysis tools
• No login or account required

Who Should Choose Google Admin Toolbox Messageheader:

• Gmail and Google Workspace users who need a quick, reliable first-pass analysis
• IT administrators troubleshooting delivery delays within Google’s email infrastructure
• Anyone who wants a clean visual timeline of server hops without extra complexity

Pricing: Free.

2. MXToolbox

Quick Summary

The most comprehensive email header analyzer available. MXToolbox parses headers according to RFC 822 and provides SPF, DKIM, and deliverability analysis alongside routing data.

MXToolbox goes beyond basic header parsing. It checks authentication results, blacklist status, and relay information in a single report. The tool also links directly to MXToolbox’s broader suite of DNS, DMARC, and deliverability tools.

For teams managing email at scale, MXToolbox’s paid Delivery Center adds inbox placement testing, DMARC monitoring, and bulk sender compliance checks.

Key Features:

• RFC 822-compliant header parsing with detailed field-by-field breakdown
• SPF, DKIM, and DMARC authentication result analysis
• Hop delay detection and relay information
• Links to MXToolbox’s DNS lookup, blacklist check, and DMARC monitoring tools

Who Should Choose MXToolbox:

• Email marketers and sysadmins who need comprehensive authentication and deliverability analysis
• Teams troubleshooting SPF, DKIM, or DMARC failures alongside routing issues
• Organizations that need a full email infrastructure diagnostic toolkit, not just header parsing

Pricing: Free header analyzer. Delivery Center plans from $129/month.

3. WhatIsMyIPAddress Email Header Analyzer

Quick Summary

WhatIsMyIPAddress offers a straightforward header analyzer alongside helpful educational content explaining what each header field means.

This tool is a good choice if you’re new to email headers. The site includes detailed explanations and examples of header fields alongside the analyzer itself.

The analysis output is simpler than MXToolbox’s, focusing on the core routing and sender information rather than deep authentication diagnostics.

Key Features:

• Clean, beginner-friendly interface with educational content
• Parses sender, recipient, routing, and timestamp information
• Includes reference examples of common header formats

Who Should Choose WhatIsMyIPAddress:

• Beginners who want to understand email headers while analyzing them
• Non-technical users who need a simple, no-frills tool for basic header parsing

Pricing: Free.

4. Microsoft Message Header Analyzer

Quick Summary

Microsoft Message Header Analyzer is Microsoft’s open-source header parser, available both as a web page and as an Outlook add-in that reads the open message directly.

Microsoft used to host a header analyzer inside the Remote Connectivity Analyzer. It pulled that in January 2020. Microsoft’s own change list records the reason:

Removed the locally hosted copy of the Message Header Analyzer in favor of the publicly supported open-source version.

The open-source build is the one Microsoft now points people to.

The replacement is MHA, published by Microsoft on GitHub under an MIT license. Microsoft describes the output as “a breakdown of each hop that the message took, and details about all the non-received messages.”

The Outlook add-in is the part worth having. It reads headers straight from the message you have open, so there’s no copying and pasting. It also works on Outlook for iOS and Android.

The limitation is permissions. The add-in requests ReadWriteMailbox access, and its own developer explains why in the project README:

If I could request fewer permissions I would, since I only ever read the one property, but I have no choice in the matter.

Plenty of IT teams block the add-in for exactly that reason. The standalone web version needs no permissions at all.

One trap: Microsoft’s own Connectivity Analyzer documentation still tells readers the header analyzer is included in the Remote Connectivity Analyzer. Microsoft removed it six years ago, and that page carries a 2013 revision note.

5. Gaijin Email Header Analyzer

Quick Summary

Gaijin is a simple email header parser that extracts and displays key fields in a readable table format.

Gaijin’s analyzer is no-frills by design. Paste a header, click analyze, and get a clean table of parsed fields. It’s a solid backup option when other tools don’t return the specific field you need.

The tool also offers additional utilities for IP lookup, DNS queries, and other network diagnostics on the same site.

Key Features:

• Simple table-based output showing all parsed header fields
• Additional network tools (IP lookup, DNS) available on the same site
• Lightweight and fast with no account required

Who Should Choose Gaijin:

• Users who want a fast, minimal tool for quick header parsing
• Anyone who needs a backup analyzer when primary tools miss specific fields

Pricing: Free.

6. DNSChecker Email Header Analyzer

Quick Summary

DNSChecker parses raw headers into a hop by hop delivery timeline, with SPF, DKIM and DMARC results shown alongside.

The analyzer reads the Received chain and shows the delay at each hop. That is the quickest way to find where a message actually stalled, rather than guessing from the total send time.

Authentication results are reported as pass or fail against the sending domain. Because the same site carries MX, DNS and blacklist lookups, a header pointing at a sender configuration problem can be followed up without moving to another tool.

The interface carries ads, and the toolset is broad rather than email specialised, so the header view is less detailed than MXToolbox returns.

Key Features:

• Received chain breakdown with the delay shown at each hop
• SPF, DKIM and DMARC results against the sending domain
• MX, DNS and blacklist lookups on the same site
• No account required and no cap on the number of headers

Who Should Choose DNSChecker:

• Anyone diagnosing a slow or failing delivery who also wants the sender DNS records within reach
• Teams who would rather not move between a header parser and a separate lookup tool

Pricing: Free.

How to Read Microsoft 365 Spam Headers: SFV, SCL, BCL and compauth

Mail that passed through Microsoft 365 carries an X-Forefront-Antispam-Report header. Its short codes say why a message was delivered, junked or blocked, and most analyzers print them without explaining them.

Every definition below is condensed from Microsoft’s anti-spam message headers reference, which Microsoft last revised on July 27, 2026.

Code in the header	What Microsoft says it means
SFV:NSPM	Microsoft says spam filtering marked the message as nonspam and sent it to the intended recipients.
SFV:SPM	Microsoft says the message was marked as spam by spam filtering.
SFV:SKN	Microsoft says the message bypassed spam filtering because of an Exchange mail flow rule.
SFV:BLK	Microsoft says filtering was skipped and the message was blocked, because the sender is on the user’s Blocked Senders list.
CIP	Microsoft calls this the connecting IP address, which admins can use in the IP Allow List or the IP Block List.
CTRY	Microsoft says this is the source country or region of the connecting IP, which might differ from the original sending IP.
BCL	Microsoft says a higher bulk complaint level means a bulk message is more likely to generate complaints.
compauth reason 000	Microsoft says the message failed explicit authentication: DMARC failed and the policy is quarantine or reject.
compauth reason 001	Microsoft says the message failed implicit authentication, where the sending domain published no records or a weaker failure policy.

SCL Doesn’t Decide Spam in Microsoft 365

Plenty of header guides tell you to read the SCL score first. Microsoft’s own reference says that’s the wrong field for cloud mailboxes.

In cloud organizations, this value doesn’t determine whether the message is identified as spam or the action taken on it.

Microsoft says SCL is used primarily in on-premises Exchange environments. For Exchange Online mail, my advice is to read the SFV verdict before you look at SCL.

A Warning About Dead Header Analyzer Tools

Mailheader.org is no longer an email tool. The domain now redirects to an Indonesian online gambling site. I confirmed that on 30 July 2026 from both the apex domain and the www version.

That’s why it isn’t on this list any more. It used to be a decent lightweight parser, which is why it still shows up on roundups nobody has rechecked.

Check where a header tool sends you before you paste anything into it. Headers carry internal server names, routing paths and sometimes internal IP addresses.

A header analyzer is a place you hand over infrastructure detail about your own network. Treat an unfamiliar one the way you’d treat an unfamiliar login page.

Comparison Table

#	Tool	Pricing	Best Feature	Best For
1	Google Admin Toolbox Messageheader	Free	Color-coded delay timeline	Gmail/Workspace users diagnosing delays
2	MXToolbox	Free (paid plans from $129/mo)	RFC 822 parsing + SPF/DKIM/DMARC analysis	Sysadmins and email marketers
3	WhatIsMyIPAddress	Free	Educational content alongside analyzer	Beginners learning email headers
4	Microsoft Message Header Analyzer	Free	Outlook add-in reads headers with no copy and paste	Outlook and Exchange admins
5	Gaijin	Free	Simple table output, fast parsing	Quick, no-frills header checks
6	DNSChecker	Free	Per hop delay timeline with SPF, DKIM and DMARC	Delivery delays where sender DNS is also in question

Start Here: Your Email Header Analysis Checklist

1. Extract the header. In Gmail, click the three dots and select “Show Original.” In Outlook, open the message properties and copy the Internet Headers.
2. Run a first-pass analysis. Paste the header into Google Admin Toolbox Messageheader to check for delivery delays and routing issues.
3. Check authentication. Paste the same header into MXToolbox to verify SPF, DKIM, and DMARC results. Fix any failures at the DNS level.
4. Trace the route. Read Received lines from bottom to top. Identify which server introduced the longest delay.
5. Monitor ongoing performance. Use EmailAnalytics to track your team’s email activity, response times, and productivity over time.

If you want to test your email deliverability before sending campaigns, try the email deliverability test from Warmy.io. For a full list of recommended tools, see our guide to the best bulk email services.

Looking for more ways to analyze your email performance? EmailAnalytics works like Google Analytics for Gmail.

Once integrated, you’ll see how many emails your team sends, your average email response time, and busiest hours. Sign up for a free trial to see how it works.

Frequently Asked Questions

What is an email header?

An email header is the block of metadata that precedes the body of an email message. It contains routing information, sender and recipient details, timestamps, and authentication results like SPF, DKIM, and DMARC.

Email clients like Gmail and Outlook hide most header fields by default, displaying only From, To, Subject, and Date.

How do I view email headers in Gmail?

Open the message, click the three vertical dots in the upper-right corner, and select “Show Original.” Gmail displays a summary of authentication results at the top, with the full raw header below.

Copy the full header text and paste it into a tool like Google Admin Toolbox or MXToolbox for detailed analysis.

How do I view email headers in Outlook?

Double-click the email to open it in its own window. Go to File, then Properties (or click the arrow in the Options section of the Message tab). The Internet Headers section appears at the bottom.

Right-click inside the headers, select all, copy, and paste into an analyzer tool. That path is the classic Outlook desktop one. In new Outlook for Windows, Microsoft documents More actions, then View, then View message details instead.

Why would I need to analyze email headers?

Header analysis helps diagnose delivery problems, identify routing delays, check spam scores, verify authentication (SPF, DKIM, DMARC), and detect phishing attempts. It matters for troubleshooting emails that bounce, arrive late, or land in spam.

What is the best free email header analyzer?

Google Admin Toolbox Messageheader is the best starting point for Gmail users. MXToolbox is the most comprehensive option, offering RFC 822 parsing, authentication checks, and links to a full email infrastructure diagnostic suite.

Both are free. Start with Google’s tool for delays, then use MXToolbox for authentication issues.

How do you use Microsoft Message Header Analyzer?

Copy the full header from your mail client, paste it into the web version of Message Header Analyzer, and run the analysis. The web version needs no mailbox permissions. The Outlook add-in reads the header from the open message instead, and it requests ReadWriteMailbox access to do that.

What is DKIM in email headers?

DKIM (DomainKeys Identified Mail) is an authentication method that adds a cryptographic signature to outgoing messages. The receiving server checks this signature against a public key in the sender’s DNS records.

A passing DKIM check confirms the email wasn’t altered in transit and originated from the claimed domain.

What does the Received field in an email header mean?

The Received field records each server that handled the email during delivery. Each server hop adds a new Received line with a timestamp, server name, and IP address.

Read Received lines from bottom to top to trace the full route. Gaps between timestamps reveal exactly where delays occurred.