sysop@hub:~/tools/mail-header-reader$
mail-header-reader
"The mail took an hour." "It landed in junk." "Is this really from our bank?" The answers are in the headers, written for machines. Paste them here: you get the route as a timeline with the wait at every hop, the SPF, DKIM and DMARC results with the reason, the spam verdict, and the things that do not match. The text is read by your browser and never uploaded.
getting the headers
| Mail program | Where |
|---|---|
| Outlook (classic) | Open the message in its own window, File, Properties, copy everything from "Internet headers". |
| Outlook (new) and Outlook on the web | The three dots on the message, View, View message details. |
| Gmail | The three dots on the message, Show original, Copy to clipboard. |
| Thunderbird | More, View source (Ctrl U). Or save the message as an .eml file and drop it here. |
| Apple Mail | View, Message, All Headers. Or drag the message to the desktop and drop the file here. |
| Exchange admin | The message trace shows the route inside Microsoft 365. The headers show the whole way, including the servers before and after. |
Take the headers from the mailbox of the recipient. A copy from the Sent folder has no route and no checks yet.
what it reads
| Header | What you get from it |
|---|---|
| Received | The route in order, the server names and addresses, the protocol and whether TLS is mentioned, the time at each hop and the wait before it. Slow hops and wrong server clocks are pointed out. |
| Authentication-Results, ARC-Authentication-Results, Received-SPF, DKIM-Signature | SPF, DKIM, DMARC, ARC and Microsoft's composite result, for which domain each one passed, and whether that domain matches the visible From address. |
| From, Reply-To, Return-Path | Whether replies and bounces go somewhere else than the visible sender, and whether the display name pretends to be another address. |
| X-Forefront-Antispam-Report, X-MS-Exchange-Organization-SCL, X-Spam-Status | The spam verdict of Microsoft 365 or SpamAssassin, with the category and the reason for a bypass. |
Headers above the last server you trust can be believed. Everything below that was written by the sending side and can be invented, including Received lines. A passed DMARC check proves the domain, not the intentions of whoever owns it. Times are compared as the servers wrote them: one wrong clock shows up as an impossible delay and is flagged. For a suspicious message with its body and links, use the phish analyzer; for a bounce, the mail flow debugger; for your own domain's records, the domain check and the DMARC report reader. Reference: mail flow cheat sheet, email error codes.