Analyze an email with the Message Header Analyzer

An email doesn't arrive, lands in spam, or you doubt it really comes from the sender? The message header tells the story: which servers it passed through, how long that took and whether SPF, DKIM and DMARC were OK. With the Message Header Analyzer you read that header easily.

1. Copy the message header

• New Outlook and Outlook on the web: open the email > More actions (...) > View > View message details.
• Classic Outlook: open the email > File > Properties > Internet headers.

Select everything and copy it.

2. Analyze

1. Go to mha.azurewebsites.net, or install the Message Header Analyzer add-in in Outlook.
2. Paste the header and select Analyze headers.

3. What do you read?

• Received headers: every server and the delay per hop. A large delay shows where the problem is.
• SPF: may the sending server send on behalf of the domain?
• DKIM: is the message signed and unchanged in transit?
• DMARC: does it all match the domain's policy? A fail points to spoofing or a misconfiguration.
• Antispam header (X-Forefront-Antispam-Report): the spam score (SCL) and why Microsoft considered it spam.

Also see enable DKIM in Microsoft 365 and report spam in Outlook.

Read also

Enable DKIM in Microsoft 365 for your own domain
Report spam and phishing in the Outlook app and on your computer
Recover deleted emails in Outlook and Exchange Online

Nederlandstalige versie: Een e-mail analyseren met de Message Header Analyzer

---

More in English