What email headers tell you
Every server that handles a message adds a Received header above the others, so the path reads from the bottom up and the timestamps show where it waited. The receiving server records its SPF, DKIM, DMARC and ARC checks in Authentication-Results (RFC 8601), and forwarders that keep ARC (RFC 8617) pass earlier results along. Together they show where a message came from, how long each hop took, and why it was delivered, sent to spam or failed authentication.
Reading the result
- A long delay usually sits at one hop: a queue at the sender, greylisting, or a filtering gateway.
- DMARC needs SPF or DKIM to pass for a domain aligned with the From domain. A pass for the sending provider's own Return-Path or d= domain does not count.
- Trust the Authentication-Results your own mailbox provider added, normally the topmost; one added before the message reached your provider may be forged.
- Microsoft 365 records its verdict in X-Forefront-Antispam-Report: SCL 5 and above means spam, and SFV says why filtering was applied or skipped.
- Headers alone cannot prove a DKIM signature; paste the whole message, or use the DKIM signature validator.
Email header analyzer: questions
How do I view the full headers of an email in Gmail or Outlook?+
In Gmail, open the message, use the three-dot menu and choose Show original. In classic Outlook for Windows, open the message, choose File, then Properties, and copy the Internet headers box; in Outlook on the web, choose More actions, View, then View message details. Copy everything from the first header line down to the blank line before the body.
How do I read the Received headers of an email?+
From the bottom up. Each server that handles a message adds a Received header above the existing ones, so the lowest is the first hop, usually the sender's own server, and the topmost was added by the last server, inside your own mailbox provider. The gap between the timestamps of neighbouring headers shows where the message waited; the analyzer lists every hop with its delay.
Which Authentication-Results header should I trust?+
The one your own mailbox provider added, normally the topmost. Authentication-Results (RFC 8601) records the SPF, DKIM and DMARC checks of the server that added it, and any copy added before the message reached your provider, including one written by the sender, may be forged. Check that it starts with your provider's server name, the authserv-id.
What is the difference between From and Return-Path?+
From is the author address people see; Return-Path is the envelope sender, where bounces go and the domain SPF checks. Email services often use their own Return-Path domain, so SPF passes for them while From shows yours. DMARC needs SPF to pass for a Return-Path domain aligned with From, or a DKIM signature aligned with it.
What does SCL mean in Microsoft 365 email headers?+
SCL is the spam confidence level Microsoft's filter assigned to the message. -1 means filtering was skipped (a safe sender, a mail flow rule or internal mail), 0 and 1 mean not spam, 5 and 6 mean spam and 9 high-confidence spam. It appears in X-MS-Exchange-Organization-SCL and X-Forefront-Antispam-Report, whose SFV value says why filtering ran or was skipped.
What are ARC headers in an email?+
ARC (Authenticated Received Chain, RFC 8617) headers let forwarders and mailing lists record the authentication results they saw and seal them, so a later receiver can still trust them after forwarding breaks SPF or DKIM. Each hop adds an ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results set with the same instance number i=. The analyzer lists every set but does not verify the seals.