Email header analyzer

Runs in your browser. The headers you paste are read by the code on this page and go nowhere: MailSetupCheck has no server, and this tool makes no network requests at all.

Why headers, when the DNS checker exists

The DNS checker reads your published records. It cannot tell whether a real message passed, because three things only show up in a delivered message:

What the receiver concluded. The Authentication-Results header is written by the server that accepted the message (RFC 8601). It records spf=, dkim= and dmarc= results as that server saw them.
Alignment. DMARC passes only when SPF or DKIM passes and the domain it verified matches the domain in the visible From address. A service can pass SPF for its own bounce domain and sign DKIM with its own domain, and your DMARC still fails. DNS records alone never show this.
One-click unsubscribe. Gmail and Yahoo require List-Unsubscribe and List-Unsubscribe-Post on bulk mail, and RFC 8058 requires a DKIM signature that covers both. Those are message headers, not DNS records.

How to get the raw headers

Mail app	Where
Gmail (web)	Open the message, then the three dots, then Show original. Copy the headers from the top of the page.
Outlook on the web	Open the message, then the three dots, then View, then View message details.
Outlook for Windows	Open the message in its own window, then File, then Properties, then read Internet headers.
Yahoo Mail	Open the message, then the three dots, then View raw message.
Apple Mail	View, then Message, then Raw Source (or All Headers).

Menu names change; if yours differs, search your app's help for "view message source" or "internet headers".

What the analyzer looks at

SPF result and domain. Which domain the receiver checked (the envelope sender in smtp.mailfrom, or Return-Path) and whether it aligns with From.
DKIM results and signatures. Each signing domain (d=) and selector (s=), whether it aligns, and signature hygiene: SHA-1 signatures (forbidden by RFC 8301), a signature that does not cover From, a missing body hash, and the l= tag, which leaves appended text unsigned (RFC 6376 section 8.2).
DMARC result. Pass, fail or no policy found.
Unsubscribe headers. List-Unsubscribe with an https link, List-Unsubscribe-Post: List-Unsubscribe=One-Click, and a DKIM signature that signs both (RFC 8058 section 3.1). Untick the bulk box for transactional mail such as receipts and password resets, which does not need them.
Basics. Message-ID, Date, a Reply-To on a different domain, and whether the Received lines mention TLS.

What it cannot tell you

It reads only the headers you paste. It does not fetch DNS, so it cannot say whether your records are right today; use the DNS checker for that.
If the header block has no Authentication-Results, there is nothing to read for SPF, DKIM or DMARC results beyond the signatures themselves. Use a copy received by a major mailbox provider.
A pass on one message does not prove all your mail passes. Different tools and services send with different settings; test each one.
Received lines are written by each server in its own format. A TLS mention there is a hint, not proof of encryption on every hop.
It does not measure your reputation, spam-folder placement or Gmail's spam rate. Those live in Google Postmaster Tools and Yahoo's Sender Hub.

Fix order

DMARC fails: make either SPF or DKIM pass with your own domain. Authenticating your domain in your sending service (a custom DKIM key, a custom return-path) fixes most misalignment.
Bulk mail without one-click unsubscribe: turn it on in the sending service; most have a single setting. Then send a new test and check that both headers are signed.
Everything else in "worth fixing".

Sources: RFC 8601 (Authentication-Results), RFC 6376 (DKIM), RFC 8301, RFC 8058 (one-click unsubscribe), RFC 9989 (DMARC), Google's sender guidelines, Yahoo Sender Hub.

Also available as Markdown.