How to read email headers when a message lands in spam

In short

• Read the copy that arrived, not the one you sent: Show original in Gmail, View message details in Outlook, View raw message in Yahoo.
• The Authentication-Results line written by the recipient's provider shows whether SPF, DKIM and DMARC passed, and for which domain.
• If all three pass, authentication is not the cause. The headers have narrowed it down to reputation, complaints or content.
• Gmail explains its decision in a banner on the message in Spam, Microsoft in the X-Forefront-Antispam-Report header, Yahoo not at all.
• At Microsoft, read CAT and SFV. As of August 2026, the SCL number no longer decides the verdict in cloud mailboxes.

To find out why an email went to spam, open the raw message in the mailbox that received it and read the Authentication-Results line near the top. It records whether SPF, DKIM and DMARC passed, the three checks that prove a message really comes from your domain. A failure there is your cause; if all three passed, authentication is ruled out and the reason lies in reputation, complaints or the message itself. Of the big three providers, only Microsoft writes its spam verdict into the headers: Gmail shows a reason in a banner above the message, and Yahoo shows none.

Open the copy that arrived, not the one you sent

Headers are the lines a message collects on its way: who handed it to whom, and what each server checked. The copy in your Sent folder has none of the receiving server's lines, so you need the message as it arrived. Send the same email to test mailboxes of your own at Gmail, Outlook.com and Yahoo, using new accounts that have never exchanged mail with you. Or ask the recipient to copy the raw text for you. An ordinary forward does not help, because it creates a new message with new headers.

Where to find the raw message, as of October 2026:

• Gmail: open the message, click More next to Reply, then Show original. A new window shows the full text, and Copy to clipboard copies it (Gmail Help).
• Outlook on the web, Outlook.com and the new Outlook: select More actions at the top of the message, then View and View message details. In classic Outlook for Windows, open the message in its own window and choose File, then Properties; the headers are in the Internet headers box (Microsoft Support).
• Yahoo Mail: open the message, click the More options icon, then View raw message (Yahoo Help).

Two analyzers run by the providers themselves turn the raw text into a table: Google's Messageheader and Microsoft's Message Header Analyzer.

A message to read along with

These are the lines that matter from an email sent by anna@northquay.example and received at a Gmail address. The rest of a real header is routing detail. Names and numbers are made up, with the .example ending and an address range reserved for documentation.

Return-Path: <anna@northquay.example>
Received: from mail.northquay.example (mail.northquay.example. [203.0.113.25])
        by mx.google.com with ESMTPS id …
        for <…>; Mon, 05 Oct 2026 06:14:09 -0700 (PDT)
Authentication-Results: mx.google.com;
       dkim=pass header.i=@northquay.example header.s=mail2026 header.b=Xk3pQ9aB;
       spf=pass (google.com: domain of anna@northquay.example designates 203.0.113.25 as permitted sender) smtp.mailfrom=anna@northquay.example;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=northquay.example
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=northquay.example; s=mail2026; …
From: Anna Keller <anna@northquay.example>
Subject: Quote for the autumn order

Authentication-Results: who checked, and what passed

This is the line in which the receiving server writes down its checks. Its format is defined in RFC 8601, and both Google and Microsoft point senders to it. Read it in three steps.

1. Check who wrote it. The first word after the header name is the server that did the checking, here mx.google.com. A message can carry several such lines, and RFC 8601 warns that a sender can forge one. Trust only the line written by the recipient's own provider. It is the topmost.
2. Read the three results. Each has the form method=result, followed by the domain the result applies to.
3. Compare the domains. The domain after header.from is the one your reader sees. It should be yours, and the SPF or the DKIM domain should belong to it.

In the example all three name northquay.example, which is the clean case. If the dkim= part shows the domain of your mailing service, or smtp.mailfrom= shows a bounce domain you do not recognise, a message can pass SPF and DKIM and still fail DMARC.

Any result other than pass deserves a look. fail and softfail mean the check ran and the message did not meet it. none means there was no record or signature to check. temperror is a temporary DNS problem, so test again before you change anything; permerror means a record is broken. Text in brackets is a comment for human readers and not part of the result.

The verdict: what each provider writes down, and what it keeps to itself

Authentication tells you who sent the message. Whether the filter liked it is a separate decision, and the three large providers differ in how much of it they show.

Gmail shows a banner, not a header

Google documents no header that carries Gmail's spam decision. What it provides is a notice on every message in the Spam folder, where you can, in the words of Gmail Help, "find a warning at the top of each email that explains why Gmail sent it to Spam". For Gmail, that one sentence is the most useful thing a recipient or a test mailbox can give you.

The wording on screen is more specific. Al Iverson of Spam Resource collected the banners in October 2025. Two of them read "This message is similar to messages that were identified as spam in the past" and "This message was marked as spam because previous messages from example.com were marked as spam". Neither names a single fault. Both point at reputation and content, which no header shows.

Microsoft writes the verdict into the headers

Microsoft 365 stamps every incoming message with an X-Forefront-Antispam-Report line. The same email, received in a Microsoft 365 mailbox and filed as junk, might carry this:

Authentication-Results: spf=pass (sender IP is 203.0.113.25)
 smtp.mailfrom=northquay.example; dkim=pass (signature was verified)
 header.d=northquay.example; dmarc=pass action=none
 header.from=northquay.example; compauth=pass reason=100
X-Forefront-Antispam-Report: CIP:203.0.113.25;CTRY:CH;LANG:en;SCL:5;SRV:;
 IPV:NLI;SFV:SPM;H:mail.northquay.example;PTR:mail.northquay.example;
 CAT:SPM;SFTY:;DIR:INB;
X-Microsoft-Antispam: BCL:0;

In the example, authentication passes, the IP is on no list, there is no bulk flag, and the result is still SFV:SPM with CAT:SPM. Nobody blocked the sender by hand. Microsoft's troubleshooting guide attributes that combination to the spam filter's own analysis of the message.

These fields are documented for Microsoft 365, the work and school mailboxes. For Outlook.com and Hotmail, Microsoft's postmaster site says only that the filter stores a spam confidence level in the message, so treat what you find there as a hint.

Yahoo shows nothing beyond authentication

Yahoo's sender documentation names no header that carries its verdict. Look for the Authentication-Results line added by a yahoo.com server and read it as above. For the rest, the Yahoo Sender Hub is at least frank about how it decides: "We usually do not redirect mail to the Spam folder for poor reputation alone." It names reputation combined with complaints, obfuscated URLs, a sending IP without a proper host name in its reverse DNS, or a message that breaks the standards.

Other mail servers: X-Spam-Status

If the recipient's mail runs at a web host or on a company server, you may find an X-Spam-Status line. It comes from SpamAssassin, an open-source filter, and lists the score, the threshold (5.0 unless the administrator changed it) and the names of the rules that fired. Google, Microsoft and Yahoo document nothing of the kind for their mailboxes, so do not go looking for it there.

The Received lines: read the ship's log from the bottom up

Each server that handles a message adds a Received line above the ones already there, so the oldest entry is at the bottom. You need them for one thing: to see which IP address delivered your email to the recipient's provider. In the example it is 203.0.113.25, in the top Received line and again in the SPF comment. Microsoft repeats it as CIP.

That address is the one IP reputations and blocklists refer to. If it belongs to your email service, you share it with other customers, and Google notes that the activity of any sender on a shared address affects the reputation of all of them.

From what you found to what to do

What the headers cannot tell you

No provider writes your reputation into a header. Gmail says it "combines user reports and other signals, with authentication information, when classifying messages", and those other signals stay on Google's side. Headers work by elimination: they tell you what the cause is not and, at Microsoft, which part of the filter acted.

For the rest there are the providers' dashboards, built for senders with volume. Google's Postmaster Tools may leave out days on which you sent little, "to protect the privacy of Gmail users", and Microsoft's SNDS reports on IP addresses, which helps only if the address is yours.

For a small sender, test mailboxes, banners and headers are most of the evidence there is. WarmupBay adds one more reading. Its dashboard shows where the warmup emails from your mailbox landed, in the inbox, in a Gmail tab or in spam, grouped by Google and other providers, and an inbox rate once at least 20 have been delivered. That tells you how your mailbox is being treated. It is not a test of your campaign text, and it does not show headers. Microsoft 365 and Outlook.com mailboxes cannot be connected yet.

Questions people ask

Is it safe to paste email headers into an online analyzer?

Headers contain email addresses, server names, IP addresses and message IDs, and the raw view usually includes the text of the message as well. Copy only the header block, down to the first empty line. The analyzers run by Google and Microsoft are the obvious choice, since those companies handle the mail anyway. Remove the recipient's address before you post headers in a public forum.

How do I get the headers from a recipient who is not technical?

Ask them to open your message, choose Show original in Gmail, View message details in Outlook or View raw message in Yahoo, copy everything and send it to you in a new email. If the message is in Gmail's Spam folder, ask them to copy the sentence in the banner at the top as well. That sentence is often worth more than the headers.

Why does the same email pass DKIM at one provider and fail at another?

Usually because the message was changed or delayed on the way to one of them. Automatic forwarding and mailing lists can alter a message so that the signature no longer verifies, and a temporary DNS error shows up as temperror at one provider only. Compare the Authentication-Results lines of both copies. Gmail also treats signatures made with keys shorter than 1024 bits as unsigned.

What does the question mark next to my name in Gmail mean?

Gmail shows a question mark next to the sender's name when a message is not authenticated: it could not confirm that the message comes from the person who appears to send it. In the headers you will find spf or dkim without a pass. Gmail's help adds that such messages are not necessarily spam, but for a sender it is a clear sign to fix authentication first.

What does "via" next to my address mean in Outlook?

Microsoft 365 can add "via" and a second domain when the domain in your From address differs from the domain in the DKIM signature or in the envelope sender. It means another service sent the message for you and put its own name on it. The tag goes away when the DKIM signature or the envelope sender uses your domain or a subdomain of it.

Can I tell from the headers whether my email went to Promotions?

Google documents no header that shows the inbox category. Promotions is one of the tabs of the Gmail inbox, described by Google as the place for deals, offers and other promotional emails, so a message there was delivered. A recipient can drag it to Primary, and Gmail says that helps it sort future mail. Since July 2026, Microsoft 365 also tags bulk mail as Promotions and can move it to a Promotions folder if the organisation's administrator turns that on.

Sources

1. Trace an email with its full header – Gmail Help
2. Check if your Gmail message is authenticated – Gmail Help
3. Report spam in Gmail (warnings shown on messages in Spam) – Gmail Help
4. Organize your emails into categories – Gmail Help
5. Email sender guidelines – Google Workspace Admin Help
6. Postmaster Tools dashboards – Gmail Help
7. Messageheader – Google Admin Toolbox
8. View internet message headers in Outlook – Microsoft Support
9. Anti-spam message headers – Microsoft Learn (updated July 2026)
10. Spam confidence level (SCL) – Microsoft Learn (updated August 2026)
11. Bulk email detection and the Promotions folder – Microsoft Learn (updated August 2026)
12. Troubleshoot common anti-spam policy issues – Microsoft Learn
13. Anti-phishing policies: unauthenticated sender indicators and the via tag – Microsoft Learn
14. Message Header Analyzer – Microsoft
15. Fighting Junk Email – Outlook.com Postmaster
16. Services for Senders and ISPs (SNDS, JMRP) – Outlook.com Postmaster
17. Find delivery delays and identify sender in New Yahoo Mail – Yahoo Help
18. FAQs – Yahoo Sender Hub
19. RFC 8601: Message Header Field for Indicating Message Authentication Status
20. RFC 5321: Simple Mail Transfer Protocol, section 4.4 (trace information)
21. Mail::SpamAssassin::Conf – Apache SpamAssassin documentation
22. Gmail: Nine reasons your mail went to spam – Al Iverson, Spam Resource (13 October 2025)