What the tools can establish.

Received headers

The journey follows Received fields from bottom to top, preserving their original order. Each timestamp is reported by the server that added that field. Adjacent differences may include queueing and processing as well as clock error. We do not sort by timestamps, invent missing hops or interpret the final receiver as proof of inbox placement.

A header-only check cannot establish which earlier records were forged. Identify your receiving system’s trust boundary and correlate with message trace or SMTP logs. TLS tokens are reported evidence, not an independent test of encryption or certificate validation.

Supported timestamps have explicit numeric UTC offsets or recognised obsolete US/UT/GMT zones. Unparsed timestamps, leap seconds and negative intervals are retained and flagged. The Date field is not used as a transport starting time.

• RFC 5321 — SMTP trace information
• RFC 5322 — message syntax and dates
• RFC 8601 — Authentication-Results and trust boundaries

DNS and authentication

The DNS tools use the server’s resolver. Answers can differ with time, cache state, location and DNS changes. They do not test every authoritative server or validate DNSSEC. SPF checks are for the entered IP and envelope-sender/HELO domain, not the visible From address. The evaluator supports qualifiers, IPv4/IPv6 CIDRs, a, mx, include, redirect, exists and ptr, with path and void limits. Policies requiring macro expansion are reported as indeterminate.

DMARC discovery uses the RFC 7489 organisational-domain method and a bundled Public Suffix List, including its private section. Receiver implementations and later specifications can differ. A published DKIM key is not a verified signature. BIMI publication checks do not certify logo format, certificate chains or eligibility to display a logo.

• RFC 7208 — SPF
• RFC 7489 — DMARC
• Public Suffix List
• RFC 6376 — DKIM, RSA key requirements and Ed25519 keys
• BIMI implementation guide

Transport policies and Microsoft fields

MTA-STS checks the DNS version record, HTTPS policy and MX coverage. It does not test SMTP certificates or a receiver’s cached policy. TLS reporting is separate from enforcement. Microsoft fields are reported as stamped; their interpretation depends on the service’s filtering and mail-flow policies.

• RFC 8461 — MTA-STS
• RFC 8460 — TLS reporting
• Microsoft anti-spam header reference