About MailTraceKit

What it does

The email header analyzer reads the technical headers that every message carries and turns them into a delivery timeline, an origin IP, authentication results and warnings about common spoofing tricks. The DNS tools check the records that decide whether your own mail is trusted: SPF, DMARC, DKIM and MX, together in the domain health check, plus generators for SPF and DMARC records.

How it works

There is no server-side code. The pages are static files, and all parsing happens in JavaScript in your browser:

• Header analysis is entirely local. Pasted headers and opened .eml files are never uploaded; the analyzer itself sends nothing anywhere.
• DNS checks ask Cloudflare’s public resolver. The SPF, DMARC, DKIM, MX and health tools query cloudflare-dns.com (the DNS-over-HTTPS service of 1.1.1.1) directly from your browser, using its JSON API, and interpret the answers locally.
• Standards, not guesses. The checks follow the published specifications: RFC 5322 and 2047 for headers, RFC 5321 for Received lines, RFC 8601 and 8617 for authentication results and ARC, RFC 7208 for SPF, RFC 7489 for DMARC, RFC 6376, 8301 and 8463 for DKIM, RFC 7505 for null MX, and RFC 8460 and 8461 for TLS reporting and MTA-STS.

Limits worth knowing

• The analyzer shows the SPF, DKIM and DMARC results that receiving servers recorded. It does not re-verify DKIM signatures itself, because that needs the full message body and the key as it was at delivery time.
• Headers below your own provider’s first Received line can be forged by the sender, so treat them as claims.
• DNS answers can be cached for minutes or hours, so a record you just changed may take a while to show up.

MailTraceKit is free to use, needs no account, and shows no ads. Page views are counted with Cloudflare Web Analytics, which works without cookies or cross-site tracking and never receives what you type, paste or drop into the tools. Read exactly what happens to your data on the privacy page.