What the analyzer shows
Delivery path. Every server that handles an email adds a Received: line at the top, so the list reads newest first. The analyzer flips it to oldest first and works out the delay between hops from their timestamps. A message that took two hours to arrive usually got stuck at one hop, and this is how you find which one.
Authentication. The SPF, DKIM, DMARC and ARC results your provider recorded, with a one-line explanation of what each one tests.
Red flags. A Reply-To on a different domain than the From address, a From domain that didn't sign the message, a failed DMARC check, or a header set with no Received lines at all.
SPF, DKIM and DMARC in plain English
| SPF | The domain in the hidden envelope sender (Return-Path) publishes a list of servers allowed to send for it. Pass means the sending server was on the list. It says nothing about the From address you see. |
| DKIM | The sending domain signs the message with a private key; the receiver checks it with the public key in DNS. Pass means the signed parts weren't changed in transit. The signing domain is the d= value. |
| DMARC | Ties the two to the visible From domain: it passes only if SPF or DKIM passed for a domain that matches the From address. This is the check that stops someone sending as your bank from their own server. |
Since February 2024, Gmail and Yahoo require bulk senders to pass DMARC, so a legitimate company's email that fails it is rare. Treat a DMARC fail on a message asking you to log in or pay as a strong sign of phishing.
Common reasons for a delayed email
If a verification code shows up late, the hop table usually tells you why. A long gap at the first hop means the sender's own queue was slow. A gap at the receiving server often means greylisting: the server refuses the first attempt and waits for a retry, which honest senders make after a few minutes. For codes that never arrive at all, see verification code not received, and use the MX lookup to confirm the receiving domain's mail servers.
Questions
Where do I find the raw headers?
Gmail: open the email, click the three-dot menu, then Show original. Outlook on the web: three-dot menu, View, View message source. Apple Mail: View, Message, All Headers. Thunderbird: View, Message Source (Ctrl+U). Copy everything above the first blank line, or the whole thing; the analyzer stops at the body.
Are the headers uploaded?
No. They're parsed by JavaScript in this page and never leave your browser. Headers can contain your address and IP addresses, so that matters.
Can I trust the SPF, DKIM and DMARC results shown?
They're the results your own mail provider recorded when it received the message (the Authentication-Results header). The analyzer doesn't re-check signatures; it reads and explains what the receiving server decided. Headers lower down can be forged by the sender, which is why the topmost results, added by your provider, are the ones that count.
Why is the delay negative on one hop?
The servers' clocks disagree. Each server stamps its own time, so a few seconds of negative delay just means one clock is ahead. Large gaps (minutes or hours) usually point to greylisting, a spam filter queue or a sender that was throttled.