Email Header Decoder Beta
Paste the headers of any email and read, in one sentence, why it passed or failed SPF, DKIM, and DMARC, and what to fix.
Nothing you paste leaves your browser. Read how.
This page has no server behind it. The headers you paste are read by code running on this page, in your browser, and are never sent, stored, or logged anywhere.
It makes no network requests at all: no fonts, no analytics, no DNS lookups. Its Content Security Policy has no connect-src, so the browser itself blocks any attempt to send data out.
Gmail: More, Show original, Copy to clipboard. Outlook: More actions, View, View message details. Classic Outlook: open the message, File, Properties, Internet headers. Apple Mail: View, Message, Raw Source.
What it reads
- SPF, DKIM, and DMARC as the receiving server recorded them, each identifier checked for alignment with the From domain.
- A second DMARC result worked out on the page from those identifiers, set beside the receiver's own, with the reason when the two disagree.
- Forwarded mail. ARC headers show what passed before a forward, so the page can say when the forward broke a message the sender set up correctly.
- Every hop in order, with the delay at each one, TLS where the stamp records it, and the point where the receiver took custody. Hops above that point could have been written by the sender.
- Spam filter headers from Microsoft 365, Google, Proofpoint, Mimecast, Cisco, Barracuda, SpamAssassin, and Rspamd, decoded in plain words with the raw value beside each one.
- The sending platform, named only when the evidence is strong, and the unsubscribe headers, including RFC 8058 one-click.
How to copy the headers
- Gmail
- Open the message, select More next to Reply, then Show original. Select Copy to clipboard, or paste the whole page here.
- Outlook and Outlook on the web
- Open the message, select More actions, then View, then View message details. Copy everything in the box.
- Classic Outlook for Windows
- Double-click the message to open it, then select File, then Properties. The headers are in the Internet headers box.
- Apple Mail
- Select the message, then View, Message, Raw Source.
- Any client
- Save the message as an .eml file and drop it on the paste box. Only the headers are read; the body is ignored.
Use the copy the recipient received. A copy from the Sent folder never passed through the receiving server, so it carries no authentication results.
Questions
Why did a forwarded message fail DMARC?
A forward sends the message on from the forwarder's server, so SPF checks the forwarder's address instead of the original sender's. If the forwarder also changes the message, for example by adding a footer, the DKIM signature no longer matches. With both gone, DMARC fails even though the sender did nothing wrong. When the forwarder adds ARC headers, this page reads the results recorded before the forward and says so.
Does anything I paste leave my browser?
No. The page has no server behind it and makes no network requests. Its Content Security Policy blocks any attempt to send data, so your headers stay on your machine.
Why are there two DMARC results?
The receiving server writes its DMARC result into the Authentication-Results header. This page also works the result out from the SPF and DKIM results and the domains involved. When the two differ, the page names the reason, such as a local policy override at the receiver.
Why does it not verify DKIM signatures or look up DNS?
Checking a signature again needs the message body exactly as sent and a DNS lookup of the public key. The receiving server already did that check at delivery, and its result is the one that decided where the message went. This page reads that result and makes no DNS lookups, so nothing about your message leaves the page.
What does "aligned" mean?
DMARC passes only when SPF or DKIM passes for a domain that matches the domain in the From address. A pass for some other domain, such as a mailing platform's own, is a pass that is not aligned, and it does not count toward DMARC.