Analyze Email Headers with Message Header Analyzer

An email arrives hours late, keeps landing in Junk, or you doubt it really comes from the sender? The message header tells the whole story: which servers the message passed through, how long each hop took, whether SPF, DKIM and DMARC passed and why Microsoft considered it spam. That header is long and hard to read, but with the Message Header Analyzer you see within seconds where things go wrong.

When do you use it?

• An email arrives with a delay of hours.
• A message from a customer or supplier keeps ending up in spam or quarantine.
• You suspect phishing or spoofing: the display name looks right, but the address or server doesn't.
• You've just set up SPF, DKIM or DMARC and want to check that it works.

Always use the header from the recipient's mailbox. The copy in Sent Items doesn't contain that information. If the message never arrived, the header can't help you; use message trace in the Exchange admin center instead.

1. Copy the message header

• New Outlook and Outlook on the web: open the email > More actions (...) > View > View message details.
• Classic Outlook for Windows: open the email in its own window > File > Properties. The header is at the bottom under Internet headers.
• Someone else's message: ask the recipient to forward it as an attachment, which keeps the original header intact.

Click in the text box, select everything with Ctrl+A and copy with Ctrl+C.

2. Analyze

1. Go to mha.azurewebsites.net, the web version of Microsoft's Message Header Analyzer. The same analysis is also built into the Microsoft Remote Connectivity Analyzer. If you use it often, install the Message Header Analyzer add-in in Outlook so you no longer need to copy the header.
2. Paste the header and select Analyze headers.

3. What do you read?

Received headers

Every server that handled the message, with the delay per hop. If you see minutes or hours of delay somewhere, you know which server (the sender's, an external filter or Microsoft's) is causing it.

SPF, DKIM and DMARC

• SPF: is the sending server allowed to send on behalf of the domain?
• DKIM: is the message signed and unchanged in transit? For your own domain, set it up as in enable DKIM in Microsoft 365.
• DMARC: do SPF or DKIM align with the domain in the From address? A fail points to spoofing or a misconfiguration.
• compauth: Microsoft's composite verdict. compauth=pass is good; fail means Microsoft doesn't trust the sender.

The antispam header

In X-Forefront-Antispam-Report and X-Microsoft-Antispam you'll find, among other things:

• SCL (Spam Confidence Level): from -1 (filtering skipped) to 9. From 5 upwards Microsoft treats the message as spam.
• BCL (Bulk Complaint Level): how likely it is to be bulk mail such as newsletters.
• SFV: the filter verdict, for example SPM (spam), NSPM (not spam) or SKA (skipped because the sender is allowed).
• CAT: the category, such as PHSH for phishing or SPOOF for spoofing.

What do you do with the result?

• SPF or DKIM fail for your own domain: add the missing sending service (a newsletter tool, for example) to your SPF record, or have that service sign with DKIM.
• Legitimate sender in spam: first ask the sender to fix their SPF, DKIM and DMARC. If it really has to work now, read how to safely allow an email domain.
• Spoofed sender: report the message as phishing and block the domain or address.

FAQ

Is it safe to paste a header into a website?

The Message Header Analyzer is an open-source Microsoft project. A header does contain email and IP addresses, though, so don't paste it into random tools.

Can I analyze the header of an email I sent?

Not usefully. Ask the recipient for the header or for the message as an attachment.

Does it work for Gmail or other services?

Yes, the tool reads any standard email header. Only the Microsoft-specific antispam fields will be missing.

Nederlandstalige versie: E-mailheaders analyseren met Message Header Analyzer

Related articles