Raw headers: From alignment, DKIM-Signature, Authentication-Results and Received hops. The signature is not cryptographically verified.
What does this read?
From / Return-Path / Reply-To domains, DKIM-Signature tags (d=, s=) and whether the selector has p= in DNS, SPF/DKIM/DMARC words in Authentication-Results, and the Received hop list.
There is no mathematical signature check. If it says dkim=pass, Gmail or Outlook wrote that, not IPTOOL.
How to paste
Gmail: ⋮ → Show original. Outlook: message details. Take the full header down to the first blank line. Body-only paste yields no Received.
The super box eml: or mailhdr: opens this page. header: is the HTTP security-header tool.
Frequently asked questions
Can you say the signature is valid?
No. b= is not computed here. Use the receiver’s Authentication-Results; it is often missing on the sender’s copy.
Is this a Gmail spam decision?
No. It is a path and identity summary. The folder decision is the receiver’s model.
Where do I copy from?
Gmail: ⋮ → Show original. Outlook: View → View message details. Take the full header, ideally down to the blank line.
Different Return-Path — spoofed?
Lists, forwarders and some ESPs rewrite Return-Path. Alone it is not proof of spoofing.
DKIM DNS missing?
The selector is unpublished or wrong. Check selector._domainkey on the sending MTA.
Prefix?
eml: or mailhdr: opens this page. header: is the HTTP header tool.