Email Header Analyzer - Delays, SPF/DKIM/DMARC & Gmail Rules

Paste the raw headers of an email (or its full source) and see every hop with its delay, the SPF, DKIM and DMARC results with alignment, and a checklist against the Gmail and Yahoo bulk-sender rules, plus spoofing flags. Works in bulk and as an API for support desks, deliverability consultants and security analysts.

Live DNS checks (DMARC policy, SPF lookup count, DKIM keys, reverse DNS of the sending IP) run during the analysis, and with a full message it re-verifies SPF and DKIM using mailauth.

Input examples

{ "headers": ["Received: from mail.example.com ...\nAuthentication-Results: mx.google.com; spf=pass ...\nFrom: News <news@example.com>\nSubject: Hi\n\n"] }

{ "emlUrls": ["https://example.com/samples/bounce.eml"], "treatAsBulk": "yes" }

{ "headers": ["<headers of a message>"], "doDnsChecks": false }

Empty input {} analyzes a built-in sample message.

Input guide

Field	What it does
headers	One string per message: a header block or a full raw source.
emlUrls	Links to .eml files.
doDnsChecks	Live DMARC/SPF/DKIM-key/PTR lookups (default on). Off = pure offline parse.
verifyLive	When the source includes the body, re-verify SPF, DKIM, DMARC and ARC now.
treatAsBulk	auto (from List-Unsubscribe, List-Id, Precedence), yes or no.
maxMessages	Cap per run.

Output

Field	Meaning
from, subject, date, messageId, returnPath, replyTo	Parsed identity fields
hopCount, totalDelaySeconds, slowestHop, hops[]	Received chain oldest first: from, by, protocol, IPs, TLS, per-hop delay
spf, dkim[], dmarc	Recorded results, alignment with the From domain, live DMARC policy (p, pct, adkim, aspf)
alignmentOk	DMARC would pass (aligned SPF or DKIM pass)
live	SPF lookup count, DKIM key sizes, PTR of the sending IP
verification	Fresh SPF/DKIM/DMARC/ARC verification of the full message
bulkSenderChecks[], bulkSenderPass	pass/warn/fail/na per rule (SPF, DKIM, DMARC, alignment, TLS, one-click unsubscribe, Message-ID, PTR, key strength ...)
flags[]	Findings with severity, such as display-name-spoof, reply-to-differs, dmarc-fail, slow-hop, clock-skew

Sample row (abridged):

{"type":"message","from":{"address":"news@example.com"},"hopCount":4,"totalDelaySeconds":370,"slowestHop":{"hop":2,"delaySeconds":327},"spf":{"result":"pass","aligned":false},"dmarc":{"policy":"reject","adkim":"s","aspf":"s"},"bulkSenderPass":false,"flags":[{"severity":"medium","code":"reply-to-differs"}]}

Use it with

• Zendesk/Helpdesk exports of "did not receive my email" tickets -> this Actor.
• eml-mbox-to-json extracts messages; paste their headers here for authentication analysis.

FAQ

Does it prove authentication? Without the body it reads the results the receiving server recorded in Authentication-Results, then adds live DNS facts. With the full source it also verifies SPF and DKIM itself; DKIM can fail on stored copies that were re-encoded.

Which rules are checked? The Gmail/Yahoo sender requirements (SPF/DKIM, DMARC with alignment for bulk senders, one-click unsubscribe, TLS, valid Message-ID and Date), the SPF 10-lookup limit and DKIM key strength. Microsoft's 2025 rules are similar but not checked separately.

Limits (honest)

• Recorded Authentication-Results can be forged by an attacker in a message that was never rewritten by a trusted server; check authservId and the live verification block.
• Hop delays depend on the Received timestamps, which servers may set with skewed clocks.
• Sender reputation, spam content scoring and blocklists are out of scope.

Price

Pay per event: message-analyzed $0.002 per message analyzed. Example: 500 support-ticket headers cost $1.00. Messages that cannot be parsed are free.