Tools · runs in your browser
Header reader
Gmail put a warning on an email, or your own email lands in spam. Paste the message's headers and see which check passed, which failed, and whether it passed for the domain in the From line.
Try:
Nothing you paste leaves this page.
From:
SPF (the sending server)
DKIM (the signature)
DMARC (the From domain's rule)
If you are the sender, what to fix
Every result the receiving server wrote
| Check | Result | For | Written by |
|---|
How it decides
- It reads the top Authentication-Results header. The receiving server (Gmail's is
mx.google.com) adds it last, so it sits above the others and holds the verdict the warning banner was based on. Older ones further down were written by servers on the way. - SPF passes when the server that handed over the message is on the list published by the envelope sender's domain (the Return-Path, not the From you see).
- DKIM passes when a signature in the message checks out against a key in DNS. The signing domain is the
d=in DKIM-Signature. - DMARC passes when SPF or DKIM passed for the From domain, or a domain under the same name ("relaxed alignment":
mail.shop.examplecounts forshop.example). That match is the whole point: anyone can pass SPF for their own domain. - Sites under two-part endings such as
.co.ukor.com.auare compared on three labels for about 60 common endings. A rarer one is compared on its last two labels, so the "the From domain" line could be wrong for it. - A pass says who sent it, not that it's safe. A scammer who registers
paypa1-help.examplecan pass all three for that name.
What each Gmail warning means and which ones to act on: 'Be careful with this message': what Gmail's warning banners mean. The records themselves: SPF, DKIM, DMARC.
Your own domain's reports, read for you
DMARC digest gives your domain a free address for its DMARC reports and shows who sends as you, and whether they pass.