What is an email header, and what can it tell you about deliverability?

What is in an email header?

Every email carries a header: a block of metadata most clients hide by default. It includes the From, To, Subject and Date you see, plus dozens of technical lines you normally do not: each Received hop the message passed through, the Authentication-Results showing SPF, DKIM and DMARC outcomes, message IDs and routing details.

How to read the authentication lines

The most useful part for deliverability is Authentication-Results. It shows three verdicts: spf=pass or fail, dkim=pass or fail, and dmarc=pass or fail. A message that fails any of these is at high risk of filtering. The header also shows the domains each check aligned against, which is how you catch alignment problems that SPF and DKIM checkers alone miss.

How to read the delivery path

The Received lines record every server the message passed through, newest at the top. Reading from bottom to top shows the journey from sender to recipient, with a timestamp at each hop. Large gaps between timestamps reveal where a message was delayed, which is useful when mail is slow rather than missing.

Why analyze headers?

When an email goes to spam, the header tells you whether authentication failed, whether the sending IP looks bad, or whether a specific server flagged it. It turns guesswork into evidence. Paste a raw header into the Email Header Analyzer and it decodes the hops, auth results and timing for you, so you are not reading cryptic lines by hand.

Frequently asked questions