Free tool
Email header analyzer: SPF, DKIM, DMARC, delays and spam verdicts
Paste the full headers of an email to see why it landed where it did.
Where to find the headers
- Open the email
- Next to Reply, click More (three dots), then Show original
- Click Copy to clipboard and paste it here
Copy the headers from the copy the recipient got (or a test you sent to your own inbox). Your Sent folder has no receiver verdicts.
About this tool
About the email header analyzer
The analyzer reads the receiver's SPF, DKIM and DMARC results and checks that they align with the From domain, lays out every server hop with its delay, IP and TLS, checks one-click unsubscribe, and decodes spam verdicts such as Microsoft's SCL, BCL and SFV.
Every finding says what to change. The analysis runs in your browser tab: the headers are never uploaded or stored.
How it works
How to read the result
The banner on top gives the verdict for this one email. Below it, four cards show what the receiving server decided for SPF, DKIM, DMARC and unsubscribe, then the list of fixes, the spam filter's own verdict when the headers carry one, and the route the email took.
- SPF: the receiver checked that the sending IP is listed in the SPF record of the envelope (return-path) domain; Aligned means that domain belongs to the same organization as the From address
- DKIM: the signature's d= domain and s= selector; a pass for your sending tool's domain (d=sendtool.com) proves the tool sent it, and only a signature with your own domain counts for DMARC
- DMARC: passes when SPF or DKIM passes with an aligned domain; a fail with policy none still hurts placement, and with quarantine or reject the email goes to spam or bounces (what cold email domains need)
- One-click unsubscribe: List-Unsubscribe with an HTTPS URL plus List-Unsubscribe-Post: List-Unsubscribe=One-Click; Gmail and Yahoo require it on marketing mail from bulk senders (does cold email need it)
- Route: Received lines read from the bottom up; the analyzer puts the first server on top and shows the wait before each hop, so a long queue at the sender or greylisting at the receiver stands out
- Spam filter: Microsoft's X-Forefront-Antispam-Report (SFV, CAT, SCL), X-Microsoft-Antispam (BCL), SpamAssassin's X-Spam-Status and Gmail's X-Gm-Spam, decoded with each vendor's own meaning
Background
Why did my email go to spam? What the headers can tell you
Headers record what the receiving server decided and part of why. A DMARC fail, DKIM signed only by your sending tool's domain, an IP with no reverse DNS or a hop without TLS are visible here and fixable in DNS or in the sending tool. Microsoft also writes its verdict into the message: SFV:SPM or CAT:SPM means its filter put the email in Junk, and a BCL of 7 or more junks bulk mail under the default policy.
When every check passes and the email still lands in spam, the cause is reputation, volume or content, which headers do not record. Check the sending domain with the domain health check, the copy with the cold email copy checker, and read why Gmail sends cold emails to spam and why Outlook junks them.
Headers describe one email at one receiver. To see where a campaign lands across Gmail, Outlook and Yahoo, run a seed-list test; how reliable inbox placement tests are covers what they can and cannot tell you.
Background
Microsoft SCL, BCL and SFV decoded
Outlook.com and Microsoft 365 stamp three headers on inbound mail. The analyzer decodes the values Microsoft documents:
- SFV (spam filtering verdict): NSPM is not spam; SPM is marked as spam; SKS, SKB and BLK mean a rule or a blocked senders list marked it; SFE, SKA and SKI mean filtering was skipped by an allow list
- CAT (the policy that acted): NONE, SPM spam, HSPM high confidence spam, BULK, PHSH phishing, SPOOF spoofing, and the impersonation categories
- SCL (spam confidence level, -1 to 9): 5 or higher is generally considered bad; Microsoft says it no longer decides the verdict in the cloud, so read CAT and SFV first
- BCL (bulk complaint level, 0 to 9): 0 is not bulk, 1 to 3 few complaints, 4 to 7 mixed, 8 and 9 many; the default anti-spam policy sends BCL 7 and up to Junk
- compauth: Microsoft's composite authentication; reason 000 and 001 are failures (DMARC fail with an enforcing policy, or weak or missing records), 1xx are passes
Background
Compared with MXToolbox, Google's Messageheader and Microsoft's analyzer
MXToolbox's header analyzer, Google Admin Toolbox Messageheader and Microsoft's Message Header Analyzer parse the hops and show the raw authentication results, and Microsoft's tool also decodes its own antispam fields. This analyzer adds the alignment check against the From domain, the one-click unsubscribe check from the Gmail and Yahoo bulk sender rules, Microsoft, SpamAssassin and Gmail verdicts in one place, and a plain-language fix for every finding. The parsing happens in your browser.
For the DNS side of the same problems, the SPF, DKIM and DMARC checker reads the records themselves, and how to test SPF, DKIM and DMARC walks through each failure.
Free guide19 min read
Send 100,000 cold emails a month
Domains and mailboxes you need, DNS, warm-up, lists, copy and follow-ups, with a launch checklist, sent to your inbox.
Questions
How do I analyze email headers?
Open the email, copy its full headers (Show original in Gmail, View message details in Outlook, View Raw Message in Yahoo, View, Message, All Headers in Apple Mail) and paste them above. The analyzer shows the SPF, DKIM and DMARC results, the route with delays and any spam verdict, with a fix for each problem.
Are my headers uploaded anywhere?
No. The parser runs in your browser tab and makes no network requests with the headers. We only receive a domain and the list of fixes if you ask us to email them to you.
Can email headers show if an email went to spam?
Sometimes. Microsoft 365 and Outlook.com write the verdict into X-Forefront-Antispam-Report (SFV:SPM or CAT:SPM means Junk), SpamAssassin writes X-Spam-Status, and some Gmail messages carry X-Gm-Spam. When none of these is present, the headers show the causes (failed authentication, missing reverse DNS, slow hops) but not the folder.
What does DMARC alignment mean in the headers?
The domain that passed SPF (smtp.mailfrom) or DKIM (header.d) has to match the From domain, at least at the organizational level. If your sending tool signs with its own domain and uses its own bounce domain, SPF and DKIM pass and DMARC still fails.
What is a good SCL and BCL in Microsoft headers?
SCL 1 or below with SFV:NSPM means Microsoft treated the email as not spam. BCL 0 means it was not seen as bulk; 4 to 7 is a mixed complaint history and 7 or more goes to Junk under the default policy.
Why does the analyzer show a delay on a hop?
Each Received line carries a timestamp. The analyzer subtracts the previous one, so a long wait shows where the email sat in a queue: a scheduled or throttled send, greylisting at the receiver or a busy relay. Negative times come from server clocks that disagree.
In your AI assistant
Run the same checks in Claude or ChatGPT
Free SKILL.md files with the rules behind this tool. Install them in Claude or Claude Code, or paste them into ChatGPT, Gemini, Grok or Cursor.
Mailboxes, warm-up and sending in one place
$2.50 a mailbox a month. DNS records are set for you, and every mailbox shows its warm-up numbers from day one.
Deliverability call
Talk to our deliverability team
Book a call with the people who run our mailbox infrastructure. We look at your current setup and tell you what to change. Running 1,000+ mailboxes? We also quote a volume price below every vendor list price in our comparisons, warm-up and sending included.
- Review your domains, DNS records and current inbox placement
- Size the setup: domains, mailboxes per domain and daily volume per mailbox
- Plan warm-up and the move from your current provider or sequencer
- 1,000+ mailboxes: a volume price per mailbox for your setup
Free call
See open times in your time zone and book on this page.
Or open the booking pageLoading available times…
Open the booking page instead