Any email · more detail for Microsoft 365
Paste the headers of any email and read what they record: the route it took and how long each step lasted, how it authenticated, who sent it and where replies go. Mail that passed through Microsoft 365 or Exchange also gets what Microsoft stamped on it. It reads headers from Gmail, Exchange, Postfix, Exim and the common secure email gateways.
Applies to what you copy or download; the analysis on the page stays as it is.
Each step is a server that received the message, in the order of the route. Between them is the time that passed between two recorded receipts.
Headers only hold what travelled with the message: retries, quarantine and much of Microsoft 365’s internal processing are not in them. For Exchange Online, message trace in the Exchange admin center can show more.
Bars compare the segments with each other; the timeline’s spacing is the same for every step.
As the receiving system recorded it. This tool checks no signatures and looks up no DNS; it reports what is in the headers.
How it works
Every mail server that accepts a message adds a Received line: who handed it over, who took it, how, and when. Together they record the route, from the sender’s server through gateways and filters to the recipient’s mailbox. Servers add other headers too: authentication results, spam verdicts, IDs.
Each server puts its Received line on top of the ones already there. Read from the top, the lines run from the recipient back to the sender; the analyzer turns them round, so the timeline reads in the order the message travelled.
Each Received line ends with a timestamp. The analyzer converts them to one time zone and subtracts each from the next: the result is the time between two servers recording the message. The total runs from the first to the last recorded timestamp, not from the Date header, which the sender’s system sets and which can be wrong.
Ten minutes between two timestamps say that ten minutes passed, not who held the message. The first server may have queued it, the connection may have failed and been retried, the second server may have deferred it, a hop may not have added a line, or a clock may be wrong. The timeline shows where to look; the logs of the systems involved say why.
SPF checks whether the sending server may send for the envelope sender’s domain. DKIM checks a signature that a domain put on the message. DMARC asks whether one of the two passed for the domain in the visible From address, and tells the receiver what to do if not.
Headers only hold what travelled with the message. For a message in Exchange Online, message trace in the Exchange admin center holds Microsoft’s own record of each event, including retries, quarantine and messages that never arrived.