Email header analyser and hop timeline
Paste raw headers and get the delivery path in order, the delay at each hop, and the SPF, DKIM and DMARC results.
Email headers record every server a message passed through, in reverse order, with a timestamp at each hop — and the receiving server's verdict on SPF, DKIM and DMARC. Together they answer the two questions that matter when a message goes wrong: where did it get stuck, and did it authenticate.
Where do I find the raw headers?
In Gmail, open the message, then the three-dot menu, then “Show original”. In Outlook, open the message in its own window, then File, Properties, and copy the “Internet headers” box. In Apple Mail, View, Message, All Headers. What you want starts at “Delivered-To” or “Received” and ends at the first blank line.
Why is my message delayed at one specific hop?
Almost always greylisting or a queue backlog. Greylisting is a receiver deliberately rejecting the first delivery attempt with a temporary error and accepting the retry a few minutes later — it filters out senders that do not retry properly. A delay of several minutes at the final hop is usually this. A delay at an intermediate relay is a backlog on that relay.
What does dmarc=pass actually confirm?
That the domain in the visible From header is aligned with a domain that passed either SPF or DKIM. It does not mean the message is safe or wanted — a spammer with their own domain and correct DNS gets dmarc=pass too. It means the message genuinely came from someone authorised by that domain, which is a narrower claim than it looks.
Why do the Received headers read backwards?
Each server prepends its own line as the message arrives, so the topmost header is the last hop and the bottom is the origin. This tool reverses them so the timeline reads in the order the message actually travelled.