A Gmail email header analyzer reads what Gmail keeps two menus down: the route a message took, the services behind it, and the SPF, DKIM, and DMARC verdicts written when it arrived. In Gmail, open the message, choose Show original, copy the full header, and paste it above.
It is read in your browser and never sent or logged, which matters because headers carry your address and the sender's.
What Gmail's headers tell you
For mail in a Gmail inbox, the top Authentication-Results line is normally the verdict of Google's own servers, so it is the one to trust. Copy the whole block, because the top is the part the analyzer needs most.
Mail sent from Google Workspace shows Google on the sending side too: a Received hop through a host under google.com, or a DKIM signature with the selector google.
The via label Gmail shows beside a sender means the signing domain differs from the From domain. Google's help page on why Gmail shows via next to a sender gives the fix: sign with DKIM for your own domain, and keep the From domain the same as the one you authenticate.
Forwarded mail, and what to check next
A forward can fail SPF and break DKIM without the sender doing anything wrong. ARC, set out in RFC 8617, lets each server record the results it saw, and when a header has no Authentication-Results line, the analyzer reads the ARC copy.
The most useful message to check is your own. Send a cold email to your Gmail address, open Show original, and paste it here.
For every part of the result and what each finding asks you to change, see the email header analyzer page.