# Email header analyzer: read SPF, DKIM, DMARC and unsubscribe results

> Paste a message's raw headers and see what the receiving server recorded for SPF, DKIM and DMARC, whether each result aligns with your From domain, and whether one-click unsubscribe (RFC 8058) is set up and signed. Runs in your browser with no network requests.

By MailSetupCheck. Updated 9 October 2026. Canonical URL: https://mailsetupcheck.com/email-header-analyzer/

> **Interactive analyzer.** On the HTML version of this page (https://mailsetupcheck.com/email-header-analyzer/), paste the raw headers of a message you received. The page, running only in your browser, reads the Authentication-Results line your receiving server wrote, the DKIM-Signature headers, the From, Return-Path and Reply-To domains, and the List-Unsubscribe headers. It reports SPF, DKIM and DMARC results, whether each aligns with the From domain, whether one-click unsubscribe (RFC 8058) is correctly set up and signed, and a short fix list in two tiers (fix first, worth fixing) plus what already looks right. Nothing is uploaded and no network request is made.

## Why headers, when the DNS checker exists

The [DNS checker](/) reads your published records. It cannot tell whether a real message passed, because three things only show up in a delivered message:

- **What the receiver concluded.** The `Authentication-Results` header is written by the server that accepted the message (RFC 8601). It records `spf=`, `dkim=` and `dmarc=` results as that server saw them.
- **Alignment.** DMARC passes only when SPF or DKIM passes *and* the domain it verified matches the domain in the visible From address. A service can pass SPF for its own bounce domain and sign DKIM with its own domain, and your DMARC still fails. DNS records alone never show this.
- **One-click unsubscribe.** Gmail and Yahoo require `List-Unsubscribe` and `List-Unsubscribe-Post` on bulk mail, and RFC 8058 requires a DKIM signature that covers both. Those are message headers, not DNS records.

## How to get the raw headers

| Mail app | Where |
|---|---|
| Gmail (web) | Open the message, then the three dots, then **Show original**. Copy the headers from the top of the page. |
| Outlook on the web | Open the message, then the three dots, then **View**, then **View message details**. |
| Outlook for Windows | Open the message in its own window, then **File**, then **Properties**, then read **Internet headers**. |
| Yahoo Mail | Open the message, then the three dots, then **View raw message**. |
| Apple Mail | **View**, then **Message**, then **Raw Source** (or **All Headers**). |

Menu names change; if yours differs, search your app's help for "view message source" or "internet headers".

## What the analyzer looks at

- **SPF result and domain.** Which domain the receiver checked (the envelope sender in `smtp.mailfrom`, or `Return-Path`) and whether it aligns with From.
- **DKIM results and signatures.** Each signing domain (`d=`) and selector (`s=`), whether it aligns, and signature hygiene: SHA-1 signatures (forbidden by RFC 8301), a signature that does not cover `From`, a missing body hash, and the `l=` tag, which leaves appended text unsigned (RFC 6376 section 8.2).
- **DMARC result.** Pass, fail or no policy found.
- **Unsubscribe headers.** `List-Unsubscribe` with an `https` link, `List-Unsubscribe-Post: List-Unsubscribe=One-Click`, and a DKIM signature that signs both (RFC 8058 section 3.1). Untick the bulk box for transactional mail such as receipts and password resets, which does not need them.
- **Basics.** `Message-ID`, `Date`, a `Reply-To` on a different domain, and whether the `Received` lines mention TLS.

## What it cannot tell you

- It reads only the headers you paste. It does not fetch DNS, so it cannot say whether your records are right today; use the [DNS checker](/) for that.
- If the header block has no `Authentication-Results`, there is nothing to read for SPF, DKIM or DMARC results beyond the signatures themselves. Use a copy received by a major mailbox provider.
- A pass on one message does not prove all your mail passes. Different tools and services send with different settings; test each one.
- `Received` lines are written by each server in its own format. A TLS mention there is a hint, not proof of encryption on every hop.
- It does not measure your reputation, spam-folder placement or Gmail's spam rate. Those live in Google Postmaster Tools and Yahoo's Sender Hub.

## Fix order

1. DMARC fails: make either SPF or DKIM pass **with your own domain**. Authenticating your domain in your sending service (a custom DKIM key, a custom return-path) fixes most misalignment.
2. Bulk mail without one-click unsubscribe: turn it on in the sending service; most have a single setting. Then send a new test and check that both headers are signed.
3. Everything else in "worth fixing".

See also the [Gmail and Yahoo sender requirements](/gmail-yahoo-bulk-sender-requirements/) and the [DMARC rollout guide](/dmarc-p-none-to-reject/).

Sources: [RFC 8601 (Authentication-Results)](https://www.rfc-editor.org/rfc/rfc8601), [RFC 6376 (DKIM)](https://www.rfc-editor.org/rfc/rfc6376), [RFC 8301](https://www.rfc-editor.org/rfc/rfc8301), [RFC 8058 (one-click unsubscribe)](https://www.rfc-editor.org/rfc/rfc8058), [RFC 9989 (DMARC)](https://www.rfc-editor.org/rfc/rfc9989), [Google's sender guidelines](https://support.google.com/mail/answer/81126), [Yahoo Sender Hub](https://senders.yahooinc.com/best-practices/).