Home / Free tools / Email Header Analyzer

Free tool

Email Header Analyzer

Find out why an email went to junk, arrived late or looks fake. Paste the headers and get a plain-English answer in seconds.

  • Free, no sign-up
  • Nothing you paste is stored
  • Checks in code, AI explains
Email Header Analyzer Ready

What you get

Everything the tool shows you, in the order you need it.

Authentication results

SPF, DKIM, DMARC and Microsoft compauth, each marked pass or fail.

Microsoft 365 spam stamps

SCL, BCL, spam category and the filter verdict decoded. Most analyzers skip these.

Delivery route

Every hop with the delay between servers, so you can see where the email waited.

Warning signs

Reply-To mismatches, failed alignment and other phishing tells, marked by level.

About this tool

When an email lands in junk, arrives late or looks like phishing, the answer is in the headers. The problem is that headers are hard to read. Paste them into the tool and it shows the delivery route with the delay at each hop, the SPF, DKIM and DMARC results, and the Microsoft 365 spam stamps (SCL, BCL, spam category) that most analyzers skip. Then it explains what it found in plain English.

How to use it

  1. In Outlook for Windows, open the email, then File > Properties and copy the Internet headers box.
  2. In new Outlook or Outlook on the web, open the email, select the three dots > View > View message details.
  3. In Gmail, open the email, select the three dots > Show original, and copy everything above the body.
  4. Paste the headers into the box and select Analyze headers.

Questions people ask

Is it safe to paste my headers here?

Headers contain server names and addresses but not the message body. The tool reads them, shows the result and stores nothing.

What does SCL mean in Microsoft 365?

SCL is the spam confidence level Exchange Online stamps on every message. -1 means filtering was skipped, 0 or 1 means not spam, 5 or 6 means spam and 9 means high confidence spam.

Why does SPF pass but the email still went to junk?

SPF only proves the sending server is allowed for the envelope domain. DMARC also needs that domain to match the From address, and the content and sender reputation still count.

What is a Reply-To mismatch?

The reply goes to a different domain than the sender. Many phishing emails use this trick, so treat it as a warning sign.

Guides that go with this tool

Step-by-step articles for the problems this tool helps you spot.

What the orange clock on an Outlook email means Where is the Outbox in Outlook, and why emails get stuck there Why Outlook shows a yellow triangle and how to fix it What protocol Outlook uses now: MAPI, EWS, Graph and IMAP How many recipients Outlook allows per email and per day Finding the Mimecast tab in Outlook
Share this tool
About-the-Author

Built by Dinesh

Dinesh is an IT infrastructure specialist with more than 20 years of industry experience in email systems, Exchange Server and Microsoft 365 (Office 365). He is the founder of several tech blogs, including MailboxInsights.com, where he writes practical guides based on real work.

More free email tools

See all tools
Outlook and Microsoft 365

Outlook Rule Builder

Describe a rule in plain English and get the steps for new and classic Outlook, plus the PowerShell command.

AI builds, code checksOpen tool Writing

Out of Office Message Generator

Get three ready out-of-office replies, the Outlook steps and the PowerShell command with your dates filled in.

AI drafts, template backupOpen tool