Email header analysis: Received, DKIM, Auth-Results

Email header analysis (Received, DKIM, Auth-Results)

Raw headers: From alignment, DKIM-Signature, Authentication-Results and Received hops. The signature is not cryptographically verified.

What does this read?

From / Return-Path / Reply-To domains, DKIM-Signature tags (d=, s=) and whether the selector has p= in DNS, SPF/DKIM/DMARC words in Authentication-Results, and the Received hop list.

There is no mathematical signature check. If it says dkim=pass, Gmail or Outlook wrote that, not IPTOOL.

Examples

Source: Gmail Show originalPaste the raw headers.
Limit: b= not verifiedAuthentication-Results is the receiver’s.

How to paste

Gmail: ⋮ → Show original. Outlook: message details. Take the full header down to the first blank line. Body-only paste yields no Received.

The super box eml: or mailhdr: opens this page. header: is the HTTP security-header tool.

Frequently asked questions

Can you say the signature is valid?

No. b= is not computed here. Use the receiver’s Authentication-Results; it is often missing on the sender’s copy.

Is this a Gmail spam decision?

No. It is a path and identity summary. The folder decision is the receiver’s model.

Where do I copy from?

Gmail: ⋮ → Show original. Outlook: View → View message details. Take the full header, ideally down to the blank line.

Different Return-Path — spoofed?

Lists, forwarders and some ESPs rewrite Return-Path. Alone it is not proof of spoofing.

DKIM DNS missing?

The selector is unpublished or wrong. Check selector._domainkey on the sending MTA.

Prefix?

eml: or mailhdr: opens this page. header: is the HTTP header tool.