Analyze email headers

Headers are the envelope and the postmarks together. The ones you wrote are at the bottom: From, To, Subject, Date. Above them, every server that handled the message stamped a Received line on top, so the block reads newest first. The receiving mailbox adds the most useful line of all, Authentication-Results, where it records whether SPF, DKIM and DMARC passed from its point of view. That one line is the answer to most "why did this go to spam" questions, and it is the first thing this tool pulls out.

Everything else is supporting detail. DKIM-Signature tells you which domain signed the message and under which selector. Return-Path is where bounces go, and it is the address SPF is actually checked against, which is why it can differ from the From line. X- headers are notes servers leave for themselves, including spam scores.

Pull the headers from the copy that landed in spam, not from your outbox. If the Authentication-Results line shows dkim=pass and dmarc=pass, the message was authenticated and the filter judged it on reputation or content: a new sending domain, a shared IP with a bad neighbour, a subject line that trips a rule, or simply that recipients never engage. If it shows spf=pass but dmarc=fail, your sending service passes for its own domain while your From address is yours, and the two do not align. Sign with DKIM under your domain, or set up the custom bounce domain the service offers.

A missing Authentication-Results line means you are looking at the wrong copy. Gmail's "Show original", Outlook's "View message source" and Apple Mail's "All Headers" each give the received copy with the verdicts in it.

Each Received line carries a timestamp, so the gap between two of them is the time the message sat on the earlier server. The hop table above marks the largest gap. A wait of several minutes at the first hop after your server usually means the receiver greylisted you: it refused the first attempt and your server retried. A long wait before a scanning gateway means the gateway held the message for inspection. Gaps of a few seconds either way can be clock drift between servers and mean nothing.

If the message never arrived at all there are no headers to read, and the useful evidence is on the sending side: the bounce message, with its SMTP code, which the SMTP error code library explains one code at a time.