Email Header Analyzer

The From line, the Subject, even the Date are just claims typed by the sender's software. The Received headers are different: every mail server that handles a message stamps one on top as it passes, like a customs stamp in a passport. Reading them bottom-up replays the journey — the machine that first injected the message, each relay that carried it, and the moment of every hand-off. That's why the timeline above lists hops origin-first: the bottom Received header is where the story starts.

The per-hop delays are the diagnostic gold. A healthy hand-off takes a second or two; a hop that suddenly costs minutes points at greylisting (a receiver deliberately deferring first contact from an unknown sender), a queue backlog on an overloaded relay, or a struggling server retrying its neighbour. When someone says "your email took an hour to arrive", the Received chain names the exact machine that ate the hour. Slow is only one failure mode, though — silently junked is the other, and our guide to why emails go to spam covers that side of the story.

The authentication trio proves three different things. SPF asks whether the sending server was allowed to use the envelope sender's domain; DKIM verifies a cryptographic signature over the message; DMARC ties both back to the domain a human actually sees in From — and that tie is alignment. A message can pass SPF and DKIM for attacker-controlled domains and still fail DMARC, because neither passing domain matched the From domain. If the trio is new to you, start with SPF, DKIM and DMARC explained; and if you send any volume at all, note that the Gmail and Yahoo sender requirements now expect all three to be in order.

The classic spoofing tells are all visible in headers: a Reply-To that quietly redirects responses to a different domain, a DKIM d= that has nothing to do with the claimed sender, and look-alike domains built to survive a glance (paypal.com-verify.example.com is not paypal.com). One honest caveat: only the Received headers added by servers you trust are trustworthy — everything below the first hop your own provider stamped can be forged by the sender, "Received" lines included. And your own domain is only as safe as its DNS: SPF, DKIM and DMARC records that were right last quarter can be broken by one careless edit. CompleteStatus watches those records around the clock and alerts you the moment they change — start monitoring free.