Why did this email go to spam?

What the header analyser checks

When an email arrives, the receiving server records its verdict in the Authentication-Results header: whether the message passed SPF, DKIM and DMARC. We read that verdict and explain it, then check alignment: whether SPF or DKIM passed for the domain in the From address, or for some other domain. That’s the most common reason a message “passes SPF” but still fails DMARC.

We also trace the delivery path from the Received lines, showing each server the message passed through and any delays, and read spam scores added by Microsoft 365 (SCL and BCL) and other filters. If the message carries ARC headers, we note that it was forwarded, which commonly breaks SPF.

Common findings

• DMARC fail, authenticated as another domain: a newsletter tool or CRM sending without domain authentication, or a spoofed message. How to fix a sending service.
• Passed every check but marked as spam: the problem is content, links or sender reputation, not DNS setup.
• No authentication results: the headers were copied from the sender’s copy rather than the recipient’s. Copy them from the mailbox that received the message.

Your privacy

Headers contain email addresses and server details, so they never leave your browser. Nothing you paste is uploaded, logged or stored.