Email header analyser

Every email has two parts: the message you read, and a block of hidden lines at the top called headers. Your email app uses them to show who an email is from, who it's to, the subject and the date, but most apps hide the rest. The hidden lines record which mail servers the email passed through on its way to you, when it reached each one, and whether the sender passed security checks proving they are who they say they are. You don't need to understand them to use email, but they're useful when an email is late, goes missing or looks suspicious.

SPF checks the sending server is allowed to send for the domain in the envelope sender. DKIM checks a signature added by the sending domain, which proves the email wasn't changed on the way. DMARC checks that at least one of them passed for the same domain as the From address you see, and tells receivers what to do if not.

Look at DMARC first. If it failed, the From address may be forged. If SPF or DKIM passed but for a completely different domain to the From address, the email was sent by someone else on that company's behalf, or by someone pretending to be them. Phishing emails often pass SPF and DKIM for their own lookalike domain, so check the From domain carefully too.

Every mail server that handles an email adds a Received line to the top. Read them from the bottom up to follow the email from the sender to you. The time on each one shows when that server got it, so the gaps show where delays happened.

Some can. A sender can add fake Received lines below their own, but they can't change the lines added by servers after theirs, including your own provider's. That's why the authentication results at the top, added by your provider, are the ones to trust.