Email Header Analyzer

Email headers are metadata prepended to every email message that record the journey of the message from sender to recipient. They include the sending IP addresses and hostnames, timestamps at each hop, authentication results (SPF, DKIM, DMARC), the message ID, the subject, and information about the mail software used. Headers are added by each mail server that processes the message. They are not normally shown in email clients but are accessible via 'View Source' or 'Show Original'.

In Gmail, open the message and click the three-dot menu, then select 'Show original'. In Outlook, open the message, click File > Properties, and view the Internet Headers field. In Apple Mail, go to View > Message > All Headers. In Thunderbird, click View > Message Source. Copy the full header block and paste it into an email header analyzer to decode the routing, authentication results, and delivery path.

Received-SPF: fail means the sending IP address is not authorised in the domain's SPF record. This is added by the receiving mail server after checking SPF. A fail result does not automatically cause rejection — the receiving server's policy determines what action to take. Combined with a DMARC policy of p=reject, an SPF fail on an aligned message will cause the email to be rejected. Check the SPF record for the From domain to diagnose why the sending IP is not permitted.

X-Spam-Score (and similar headers like X-Spam-Status, X-Spam-Flag) are added by spam filtering software such as SpamAssassin, Rspamd, or the receiving mail provider's own filters. They represent the spam probability score calculated for the message. Each mail system uses its own scoring thresholds — a message scoring above a threshold may be delivered to the spam folder or rejected. These headers are not standardised; the name and scale vary by system.