"...not your dancing gran's mail header analyzer " Dancing gran!

MailHeaderAnalyzer.com

Parse email headers and present them in a modern and digestible way. Make no mistake, this is not your dancing gran's mail header analyzer; there are quite a few user/admin experience improvements over other email header analyzers.

Discover and leverage external free services for deeper investigation and identification
Search just about any header attibute value using the magnifying glasses
Message hop time delay graphing
Searchable dynamic hop table (or optional list)
Copy pretty much anything to the clipboard!
In-app domain scanning on Urlscan.io shows the resulting home page screenshot
Search URLs, Domains, and File Names found in submitted headers
View simple & quick definitions by hovering over any of the icons
Access to detailed Authentication Results Reference table with correlating colors
Access to Focus view; where headers can be viewed in a larger size, free of distractions
Analysis written report (coming soon)
Analysis PDF export (coming sooner)

We ❤️ Privacy & Security 🔒

No information submitted or entered into this web application is stored anywhere at any given time. (with the exception of volatile memory in a sandboxed runspace within containered clusters)

Some network connection information is logged in edge routing for security purposes although there is no correlatable identifying information logged as the web application does not store or log anything.

Authentication Results Reference

DKIM
DomainKeys Identified Mail

Pass: The email message has a DKIM signature and passed the mailbox provider’s verification check.
None: The email message has not been signed with DKIM so there is nothing for the mailbox provider to verify.
Fail: The email message has a DKIM signature but there was an error causing a verification failure. This result could mean that the message was modified during delivery or there was a major configuration error in the DKIM record on the sender’s server such as an unknown key version or unknown key type.

SPF
Sender Policy Framework

Pass: The receiving mailbox provider checked the SPF record of the sending domain and confirmed that the sending IP is included in the sending domain's public SPF record.
None: The sending domain does not have a published SPF record.
SoftFail: The receiving mailbox provider checked the SPF record of the sending domain and found that the record does not include the sending server's IP address. In the case of a SoftFail, the message is tagged for quarantine.
Fail: The receiving mailbox provider checked the SPF record of the sending domain and found that the record does not include the sending server's IP address. In the case of a Fail (or HardFail), the message is rejected entirely.

DMARC
Domain-based Message Authentication, Reporting, and Conformance

Pass: The receiving mailbox provider checked the DMARC record of the sending domain and confirmed that both SPF and/or DKIM are in alignment.
None: The sending domain does not have a published DMARC record.
Fail: The receiving mailbox provider checked the DMARC record of the sending domain and found that SPF and/or DKIM is not aligned.

Spam Score
Barracuda Spam Score

0 - 2: The message is considered to be relatively safe and is likely not Spam or Malicious
3 - 5: The message is considered medium confidence Spam or Malicious. Use descretion in determining a verdict.
6 +: The message is considered to be high confidence Spam or Malicious. Exercise extreme caution when making descions.

MS BCL
MS Bulk Complaint List

0: Microsoft determined the message isn't from a bulk sender.
1, 2, 3: Microsoft determined the message is from a bulk sender that generates few complaints.
4, 5, 6, 7*: Microsoft determined the message is from a bulk sender that generates a mixed number of complaints.
8, 9: Microsoft determined the message is from a bulk sender that generates a high number of complaints.

* The default threshold value used in MS anti-spam policies.

MS SCL
MS Spam Confidence List

-1: The message skipped spam filtering. For example, the message is from a safe sender, was sent to a safe recipient, or is from an email source server on the IP Allow List.
0, 1: Microsoft spam filtering determined the message wasn't spam and delivered to the recipients' inbox.
5, 6: Microsoft spam filtering marked the message as Spam and delivered to the recipients' Junk Mail folder.
8, 9: Microsoft spam filtering marked the message as High confidence spam and delivered to the recipients' Junk Mail folder.

Keyboard Shortcuts

N or n: Start new header analysis in this tab (clearing any potential existing header analysis result)
T or t: Start new header analysis in a new tab
H or h: Jump current view to the Hops table
A or a: Jump current view to the Authentication Results Headers table
S or s: Jump current view to the Barracuda Spam Headers table
X or x: Jump current view to the X- Headers table
A or a: Jump current view to the ARC Headers table
O or o: Jump current view to the Other Headers table
J or j: Jump current view to the top of the page
R or r: Show the Authentication Results Reference table
K or k: Show the Keyboard Shortcut Reference table
B or b: Navigate to bug reports and feature requests site
I or i: Show the Info section
Esc: Close any opened popup/overlay (such as this one) (clicking anywhere on the body will also close)

Ctrl + Enter: Submit a pasted header while on the new header page
Ctrl + Shift + Enter: Paste and submit a pre-defined sample header for demoing