The pasted header is evaluated exclusively locally in your browser.

What does the analysis show?

Quick overview graphic: Above the detail cards, the tool draws the complete mail flow: every station as a node, the dwell time between them color coded, markers for the tenant boundary, hybrid classification and the DMARC verification point. Dedicated tracks show from where to where the DKIM hash stayed intact (with the ARC-witnessed break point in forwarding scenarios) and from which station the ARC chain preserves the verification results.
Delivery path (Received chain): Every mail server along the way stamps the message with a Received line: who submitted it (HELO, rDNS, IP address), who accepted it, over which protocol and when. The tool orders the chain chronologically, calculates the dwell time per station and marks the longest segment: you can see at a glance where a slow delivery actually got stuck. Clock skew between servers is detected and flagged.
Transport encryption per hop: The tool extracts TLS version and cipher from the Received lines where the receiving server logs them (Microsoft, Postfix and Exim each write different formats). Stations using SMTP auth (client submission) and internal networks are labelled.
Authentication-Results: The receiving server documents its SPF, DKIM and DMARC checks in the Authentication-Results header (RFC 8601). The tool decodes the results including details such as header.d, smtp.mailfrom and Microsoft's compauth with its reason code. Important: it shows the receiving server's evaluation, not its own re-verification.
DMARC alignment: DMARC only passes if SPF or DKIM passes and the respective domain aligns with the visible From address. The tool puts the From domain, envelope from and DKIM domain (d=) side by side and evaluates strict and relaxed alignment: the most common reason a message fails DMARC despite passing SPF.
DKIM signatures in detail: All DKIM-Signature headers are broken down: algorithm, canonicalization, selector, signed header fields and validity. Warnings cover obsolete SHA-1 (RFC 8301), expired signatures, a set body length limit (l=) and an unsigned From field.
ARC chain: Forwarding and mailing lists often break SPF and DKIM; ARC (RFC 8617) preserves the original verification results. The tool shows the chain's instances, who sealed them and whether the chain is intact according to cv=.
Exchange hybrid classification: For messages from Microsoft 365 environments, the tool shows whether Exchange Online classifies the message as Originating (from the organization itself) or Incoming (from outside), and whether it is treated as Internal or Anonymous: the deciding factor for whether EOP filtering applies. It decodes AuthAs, AuthMechanism (including a warning for the externally secured value 10), AuthSource, X-OriginatorOrg and the cross-tenant headers, with a hint for attribution to the wrong tenant.
Spam filter fields: Microsoft environments: SCL, BCL, category (phishing, spoof, bulk …) and filter verdict from X-Forefront-Antispam-Report are translated field by field. Plus SpamAssassin (X-Spam-Status with triggered tests) and Rspamd (X-Spamd-Result with symbols).
Sender plausibility: Reply-To on a foreign domain, a diverging Return-Path, a Message-ID from a third party, a large gap between the Date field and the last Received timestamp: the classic clues when phishing is suspected, each with context on when they also occur legitimately.
Report for tickets: The core results (authentication plus delivery path with timings) can be copied as Markdown, ready to paste into ticket systems and incident documentation.

Where do I find the header?

Outlook (classic): Open the message with a double click, then File → Properties. The header is in the “Internet headers” field and can be copied from there.
New Outlook and Outlook on the web: In the opened message, click the three dots (…), then View → View message details.
Gmail: In the opened message, click the three dots and choose “Show original”, then “Copy to clipboard”. Pasting the complete raw message is fine as well.
Apple Mail: View → Message → All Headers. Alternatively save the message as a file and paste the beginning of the .eml file.
Thunderbird: More → View Source (or Ctrl+U) and copy the header part.
Exchange message tracking: For delivery analysis without mailbox access, message tracking only provides metadata; the full header always lives in the delivered message itself.

Feedback

Is this tool useful to you? Is a feature missing, or is a result wrong? Feedback right here in the comments is welcome.

Comments are loaded from GitHub / Giscus.