Best free email header analyzers

AdminKit is built by Netbase JSC. AdminKit is listed below; the other tools are independent.

Criteria and how we weighted them

This roundup ranks five free tools against four published criteria, in priority order:

1. Free, no login required for a single analysis — every tool here clears this bar.
2. Privacy of the pasted header text: whether the tool’s own page states the analysis happens entirely in your browser, or is silent on where the text goes once submitted.
3. Breadth: how much a single analysis surfaces beyond the Received chain and hop delay — Authentication-Results (SPF/DKIM/DMARC) decoding, BIMI brand-logo verification, and reading a receiving server’s own anti-spam-engine verdict (e.g. Gmail or Microsoft 365’s own spam score), each only counted when the tool’s own page states it.
4. Access: whether the tool is a single paste-and-analyze web page, or primarily built to run inside a specific host application.

Ranking from those criteria, not from preference, is why AdminKit sits second of five rather than first: CaptainDNS’s own page describes a wider set of sourced features for the same free, no-signup analysis — BIMI decoding, anti-spam- engine verdict reading, and spoofing/alignment anomaly flags — none of which AdminKit’s own tool page claims. AdminKit still ranks ahead of Google Admin Toolbox Messageheader, MxToolbox and Microsoft’s Message Header Analyzer (MHA) because its own page is the only one of the five that explicitly states pasted headers are parsed entirely in the browser and never sent to a server. The table below shows the same facts by feature; the list underneath explains each tool’s placement.

The ranked list, explained

1. CaptainDNS — per its own Mail Header Analysis page, read 2026-11-08, the tool is “100% free” with “no signup, no limits.” Its own page states it decodes “SPF, DKIM and DMARC from the email header” plus BIMI brand-logo verification, traces “every received hop from the sending server to the recipient” including hop delays and timestamps, shows verdicts from “Gmail, Microsoft 365 and other engines,” and flags “spoofed senders, Return-Path vs From mismatches, broken DMARC alignment and invalid DKIM signatures.” It also states “we don’t store your data,” though that is a no-retention promise, not an explicit claim that analysis happens client-side in the browser the way AdminKit’s own page states.

2. AdminKit — free, no login, and per its own tool page the only one of the five that explicitly states the Received chain, computed hop delays and Authentication-Results SPF/DKIM/DMARC verdicts are all parsed “entirely in your browser,” with nothing pasted ever sent to AdminKit or anywhere else. It ranks behind CaptainDNS specifically on breadth: AdminKit’s own page doesn’t claim BIMI decoding or anti-spam-engine verdict reading, and it ranks ahead of the remaining three because none of their own pages make an equivalent client-side privacy claim.

3. Google Admin Toolbox Messageheader — per its own page, read 2026-11-08, it’s a free, no-login tool that normalizes Received-header timestamps across time zones to “identify delivery delays,” “identify approximate source of delay” and “identify who may be responsible.” Its own page doesn’t state whether it reads Authentication-Results SPF/DKIM/DMARC verdicts, nor where the pasted text is processed, beyond a generic cookie-policy notice unrelated to header content.

4. MxToolbox — per its own Email Header Analyzer page, read 2026-11-08, it “will make email headers human readable by parsing them according to RFC 822” and surfaces “hop delays, anti-spam results and more,” free with no login mentioned. Its own page is the thinnest in stated detail of the four competitors: it doesn’t name SPF, DKIM or DMARC specifically, doesn’t say which anti-spam engines its results reference, and doesn’t state where analysis happens.

5. Microsoft Message Header Analyzer (MHA) — per its GitHub repository and standalone web page, both read 2026-11-08, MHA is MIT-licensed and open source — the one tool here whose parsing code is publicly inspectable — with a “standalone web interface” available at no login. It ranks last on this specific roundup not because it’s a weak analyzer, but because its own README documents an “Outlook add-in interface: opened from an Outlook message in supported Outlook clients” as its primary integration, and neither its README nor its standalone page’s visible content states which specific header facts (Authentication- Results, hop delay, or otherwise) the “Analysis Results” output actually breaks out.

Why isn’t mailheader.org in this roundup?

A read-only check of mailheader.org run 2026-11-08 found that both https://mailheader.org/ and https://www.mailheader.org/ return an HTTP redirect (308 and 301 respectively) to an unrelated domain that is not a header-analyzer tool at all. That’s consistent with the domain having lapsed and been re-registered by an unrelated party, not with mailheader.org still operating as a live tool — so rather than cite content from that redirect target, or describe mailheader.org from memory of what it used to offer, it’s left out of this roundup entirely. PowerDMARC’s and dnschecker.org’s own email-header-analyzer pages were also checked for this comparison, read-only, on the same date; both returned an HTTP 403 Cloudflare challenge block on every attempt (dnschecker.org’s block is already on record from two other AdminKit comparisons), so both are left out for the same reason: this page reports what each tool’s own page actually says, not a guess from memory.

Best for your specific need

• The broadest confirmed feature set in one free analysis: CaptainDNS — SPF/DKIM/DMARC decoding, BIMI, anti-spam- engine verdicts and anomaly flags, per its own page.
• Keeping pasted headers out of any server entirely: AdminKit — the only tool here whose own page makes that specific claim.
• A familiar, Google-run hop-delay diagnosis: Google Admin Toolbox Messageheader.
• Staying inside a toolset you already use for MX, blacklist or SPF/DMARC checks: MxToolbox.
• An open-source analyzer, or one built into Outlook itself: Microsoft’s Message Header Analyzer (MHA).

Where AdminKit is honestly behind

AdminKit’s email header analyzer doesn’t decode BIMI brand-logo records and doesn’t read a receiving mail server’s own anti-spam-engine verdict — CaptainDNS’s own page states both, which is why CaptainDNS ranks ahead of AdminKit on this roundup’s published breadth criterion. What AdminKit’s analyzer does today is parse the Received chain, compute per-hop delay, and read whatever Authentication-Results SPF/DKIM/DMARC verdicts a receiving server already stamped into the message — entirely in your browser, with nothing you paste sent to AdminKit or anywhere else. For a live SPF, DKIM or DMARC verdict against a domain’s current DNS, rather than a transcript of someone else’s past verdict, see AdminKit’s SPF check and DMARC check, and SPF, DKIM and DMARC explained for how the three records fit together. AdminKit’s email header analyzer sits in AdminKit’s email authentication cluster, alongside the SPF, DKIM and DMARC tools this roundup also references.

---

Trademarks belong to their respective owners; AdminKit is not affiliated with MxToolbox, Inc., Google LLC, Microsoft, or CaptainDNS.