Email Header Decoder (beta)

Paste the headers of any email and read, in one sentence, why it passed or failed SPF, DKIM, and DMARC, and what to fix.

Live at https://headers.dns-audit.com, part of dns-audit.com.

What it does that a header table doesn't

• The finding comes first. One sentence names the cause, then the fix follows as steps. A pass says there's nothing to fix.
• One output, two depths. The finding is in everyday words and names each term it uses. Technical details under it give the same finding in the protocol's own terms, with the raw lines it came from. Nobody has to pick a mode.
• Two DMARC results. The page shows the receiver's result and one it works out from the identifiers, with the reason when they disagree.
• Forwards and mailing lists read correctly. The ARC chain shows what passed before a forward, so a message the sender set up correctly isn't blamed on the sender.
• Trust comes before parsing. Authentication-Results fields a sender could have written are shown but never used. The hop timeline marks where the receiver took custody.
• Filter headers are decoded for Microsoft 365, Google, Proofpoint, Mimecast, Cisco, Barracuda, SpamAssassin, and Rspamd, with the raw value beside each one.
• Evidence points at its source. In Technical details, select a line reference and the raw header lines it came from light up.
• It says what headers can't show instead of guessing.
• Copy report gives a plain text summary for a ticket or a client email.

Privacy

After each read the page sends dns-audit.com one usage note with the overall result (pass, fail, and so on), so its maker can see the tool is used. The privacy page lists what the note holds.

Limits

The page makes no DNS lookups and verifies no signatures. It reads the results the receiving server recorded at delivery. The organizational domain comes from a short built-in suffix list. ARC seals are checked for structure, not verified.

It doesn't yet look up DKIM keys, decode bounces and SMTP codes, or compare two messages. Shareable result links are left out on purpose, because they would need a server.

Beta

It's tested against synthetic headers built from the RFCs and vendor documentation, and against a growing set of real messages. It will still get some real mail wrong. If it reads one wrong, open an issue with what it said and what it should have said. Please describe the problem rather than attaching someone else's headers.

Run it

Node 18 or later, no dependencies.

node --test test/      run the tests
node build.js          build dist/

dist/index.html is the whole tool in one file and opens from disk. The fixtures in test/fixtures are synthetic, and no real mail is committed.

Author

Built by Neil Anuskiewicz, email deliverability and DNS consultant.

License

MIT