Message Header Analyzer

Paste the internet headers of a message. You get the delivery path with per-hop delays, the SPF / DKIM / DMARC and composite-authentication verdicts, and the Exchange Online Protection values — SCL, BCL, SFV — with what each one actually means.

Everything on this page happens in your browser. Nothing you paste is uploaded, logged, or stored — you can pull the network cable and it still works.

Internet message headers

Ctrl + Enter runs it too

Getting the headers

Outlook (new) and Outlook on the web

Open the message, choose the … menu → View → View message details, and copy everything in the box.

Outlook (classic)

Open the message in its own window, then File → Properties. The headers are in Internet headers at the bottom.

PowerShell, for a message you cannot open

Get-MessageTraceV2 -RecipientAddress user@contoso.com -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) |
    Where-Object Subject -like "*invoice*" | Format-List

Message trace gives you the delivery status and the Network Message ID; the headers themselves come from the mailbox or from Threat Explorer.

Reading the result

The hop list is in delivery order — the oldest Received header first, which is the reverse of how they appear in the raw text. A large delay on one hop usually means a queue: greylisting, a slow on-premises connector, or a third-party gateway. Treat the numbers as approximate; each hop's timestamp comes from that server's own clock, so a few seconds of skew is normal and a hop can even appear to travel backwards in time.

For authentication, compauth is the one that decides. SPF, DKIM and DMARC are inputs; composite authentication is Microsoft's verdict after weighing all three plus its own signals, and it is what the anti-phishing policy acts on.