Email Authentication Chain Checker
Inspect the SPF, DKIM, and DMARC results in email headers: see each check pass or fail, spot alignment problems, and learn why your mail lands in spam.
Loading tool...
What is Email Authentication Chain Checker?
The Email Authentication Chain Checker parses raw email headers (Authentication-Results, Received-SPF, DKIM-Signature, and ARC headers) to verify how SPF, DKIM, and DMARC evaluated a message. It highlights pass/fail statuses, checks identifier alignment between the visible From domain and the authenticated domains, and explains why an email was delivered, quarantined, or routed to spam.
Key Benefits
- See SPF, DKIM, and DMARC verdicts side by side from a single pasted header block
- Detect domain alignment mismatches that cause DMARC failure even when SPF or DKIM pass
- Understand cryptic Authentication-Results syntax with plain-language explanations
- Analyze headers 100% locally in your browser without exposing private emails
Common Use Cases
- •Troubleshooting why transactional or marketing emails land in Gmail or Outlook spam folders
- •Verifying DNS cutovers after updating SPF includes, DKIM selectors, or DMARC policies
- •Investigating suspected spoofing or phishing emails during security triage
- •Auditing third-party email senders (SendGrid, SES, Mailgun) for proper domain alignment
How to Check an Email's Authentication Chain
- Get the full headers: Open the message in your mail client and choose 'show original' or 'view source'.
- Paste the header block: Copy everything above the message body into the tool's input.
- Read each verdict: Check the SPF, DKIM, and DMARC rows — each shows pass or fail plus the domain involved.
- Compare alignment: If DMARC failed while SPF or DKIM passed, look at which domain the passing check actually validated.
Key Features
- Parses Authentication-Results, Received-SPF, DKIM-Signature, and ARC headers
- Displays clear pass/fail verdicts for SPF, DKIM, and DMARC
- Checks domain alignment between visible From and authenticated domains
- Plain-language diagnostics explaining why emails land in spam
- 100% offline in-browser analysis — raw email headers stay private
Frequently Asked Questions
What does this tool check?
It reads the SPF, DKIM, and DMARC results from an email's authentication headers and shows each pass/fail verdict, the domain involved, and whether the alignment between them holds.
Where do I get the headers?
Use your mail client's "show original" or "view source" option — Gmail, Outlook, and Apple Mail all have one — and paste the full header block.
Why does DMARC fail when SPF and DKIM pass?
DMARC also requires alignment: the domain that passed SPF or DKIM must match the visible From domain. Relayed or forwarded mail often fails this even when the underlying checks pass.
Is my email uploaded anywhere?
No. Headers are parsed in your browser only — nothing is sent to a server.