Bitelio
§ T-09  —  Tool← All tools

Email headers
analyzer

Drop in raw headers and watch them decoded: SPF, DKIM, and DMARC verdicts, each server hop with its timestamp, and the complete authentication trail.

Raw header input

Only the headers are needed — leave the body out. Parsing happens entirely in your browser.

§ 01Email headers explained

Reading the forensic trail.

Headers record everything that happened to a message — if you know where to look.

/ Authentication

SPF, DKIM & DMARC

Start with Authentication-Results. In one line it tells you whether the sender was authorised (SPF), the signature held up (DKIM), and whether both align with the From domain (DMARC).

/ Routing

Received chain

The Received headers are the message's travel log, newest entry first. Reading upward from the bottom reconstructs the full route, and timestamp gaps expose exactly where a slow email got stuck.

/ Identity

Return-Path & Reply-To

Bounces flow to Return-Path, which is also what SPF validates; Reply-To redirects responses. When From, Return-Path, and Reply-To disagree, filters get suspicious — and phishers count on exactly that mismatch.

Skip the header archaeology.

With authentication configured right from the start and analytics on every send, deliverability problems surface in your dashboard — not in your users' spam folders.

Start with BitelioCheck DKIM record

Frequently asked questions

Where do I find the raw email headers?

Gmail: open the message, hit the three-dot menu (⋮), and pick "Show original". Outlook: open the message, go to File → Properties, and copy the "Internet headers" field. Apple Mail: with the message open, choose View → Message → All Headers. The header block sits at the top of the raw message source.

What do the Authentication-Results headers mean?

The receiving mail server writes this header to record the outcome of its SPF, DKIM, and DMARC checks. "pass" is success, "fail" or "hardfail" is failure, and "none" means no record existed to check. When SPF or DKIM fails while DMARC passes, look at whether your sending domain aligns with the From header.

How do I read the Received chain?

Every server that relays the message prepends its own Received header, so the newest hop sits on top. Follow them from the bottom up to reconstruct the full route from sender to inbox. A long gap between two timestamps points to queuing or a slow relay, and the bottom-most Received header reveals where the message originated.

Why does email land in spam even though SPF and DKIM pass?

Passing authentication gets you considered, not delivered. Filters also weigh sender reputation, IP blacklist status, content quality, engagement history, and DMARC alignment. A brand-new IP, a domain with no sending track record, or copy stuffed with trigger words can still sink a fully authenticated message.

What is the DKIM-Signature header?

It carries the cryptographic signature the sending server applied to the message. The "d=" tag names the signing domain and "s=" names the selector, and together they tell receivers where to fetch the public key in DNS: <selector>._domainkey.<domain>. If the key is missing or the signature doesn't verify, DKIM fails.