Email header analyzer

The receiving server records its SPF, DKIM, and DMARC verdicts in an Authentication-Results header, and that record is the closest thing deliverability debugging has to a primary source. spf=pass means the sending IP was authorized by the envelope domain's SPF record. dkim=pass means a signature validated, and the d= value beside it names the domain that signed. dmarc=pass means one of those two aligned with the visible From domain, which is what DMARC actually checks.

A message can have several Authentication-Results headers, because every forwarder can add its own. The one written by your receiving server is the first, and it is the one this tool reads when methods repeat.

Every server that handles a message prepends a Received header, so the raw block reads bottom-up: the lowest Received line is the first hop out of the sending infrastructure and the top one is the final delivery. Each line records who handed the message over, who accepted it, and when.

The timestamps turn the chain into a latency profile. Subtracting each hop's time from the next shows exactly where a slow message spent its time, and the answer is usually one hop: a queue at an intermediate relay or a greylisting pause at the receiver. A negative gap between hops is real information too; it means two servers disagree about the time, and every delay calculation that crosses that boundary inherits the error.