Email Header Analyzer

Every email carries a stack of headers — metadata added by each server along the delivery path. The headers describe who sent the message, who it was for, how it was routed, and whether it passed authentication at the receiving server.

For cold email, the three checks that matter most live in the Authentication-Resultsheader added by the recipient's mail server. If any of spf, dkim, or dmarc shows fail, the receiving server treats your message as less trustworthy — usually meaning spam or rejection.

Reading the Authentication Results

• spf=passThe sending IP is listed in the From domain's SPF record.
• dkim=passThe DKIM signature in the message verifies against the public key in DNS.
• dmarc=passSPF or DKIM passed AND the authenticated domain aligns with the visible From.

Tracing the Received Chain

Received headers stack newest-on-top — the originating server is at the bottom of the raw text, and each subsequent hop sits above it. Reading them in reverse order shows the actual delivery path. Long chains (5+ hops), unexpected relays, or timing gaps between hops are all signals worth investigating.

When Authentication Fails

A single failure is rarely fatal — providers weigh many signals — but repeated failures at scale tank reputation fast. The fix is almost always a misaligned or missing DNS record. If spf=fail, your sending IP isn't in the domain's SPF. If dkim=fail, the public key in DNS doesn't match the signing key. If dmarc=fail, the domain that passed SPF/DKIM doesn't match the visible From.