The route
Every server that touched the message left a line. We put them in order and show how long it waited at each.
Read an email’s headers.
Paste the raw headers to see where the message went, where it waited, and whether it passed the sender checks.
In Gmail: open the message, then the three dots, then “Show original”. In Outlook: File, then Properties, then Internet headers. Nothing you paste leaves your browser.
What it means.
The sender checks
Whether the message passed SPF, DKIM and DMARC at the server that received it, with the reason when it did not.
Odd things
A missing Message-ID, a Return-Path on a different domain, replies going elsewhere, or a spam filter’s verdict, in plain words.
Common questions.
How do I get an email’s headers?
In Gmail, open the message, click the three dots, then “Show original”, and copy the text. In Outlook, double-click the message, then File, Properties, and copy the Internet headers box. In Apple Mail, choose View, Message, All Headers.
What do the Received lines show?
Each server that handled the message adds a Received line at the top. Read from the bottom up, they give the route in order, with a time for each step. The gap between two steps is how long the message waited at that server.
What do SPF, DKIM and DMARC results mean?
The receiving server adds an Authentication-Results line with them. Pass means the check succeeded. Fail or softfail means the sender is not authorised by the domain, or the signature did not match. A DMARC pass needs SPF or DKIM to pass and to match the From domain.
Why did my email take so long?
Look for the step with a long wait. A pause at the first receiving server is often greylisting or a queue. A long wait inside the sender’s own system points to a slow mail server. Mismatched clocks can also make a delay look longer or shorter than it was.
Can I tell if an email is a forgery from the headers?
They help. Failing SPF, DKIM and DMARC, a Return-Path that does not match the sender, and a route that starts somewhere unexpected are all warning signs. They are not proof either way, so be careful with a message you were not expecting.
Is my email sent anywhere?
No. The headers are read in your browser and nothing is uploaded. They can contain addresses and server names, so it is still best not to paste them into tools that send them elsewhere.
Next: Check your domain · Decode a bounce message · Why emails go to spam
Want to see where every email goes?
SendSend shows what happened to each message you send: delivered, bounced, or marked as spam. Free for 3,000 emails a month.