OneTaskBy Tim King · Updated
Email Header Analyzer
Server Hop Delays and Spoofing Signs From Raw Message Headers
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Email Header Analyzer works
This email header analyzer reads the raw headers of a message and shows where it really came from. Paste the headers to see every server hop with its delay, the SPF, DKIM and DMARC results, and warnings for the signs of a spoofed or phishing email.
What the email header analyzer checks
Every mail server that handles a message adds a Received line at the top of the headers, so reading them from the bottom up gives the route from sender to inbox. The analyzer lists each hop with the server names, IP address, protocol and the time spent since the previous hop, so slow delivery is easy to spot.
The Authentication-Results header added by your provider holds the verdicts that matter. SPF shows whether the sending server was allowed to send for the domain, DKIM whether the signature matched, and DMARC whether either of them lined up with the visible From address. A DMARC failure on mail claiming to be from your bank is a strong sign of phishing.
Warnings also cover a Reply-To or Return-Path on a different domain from the From address, which is how many scams steer your reply elsewhere. To get the headers, use Show original in Gmail, View message source in Outlook or Apple Mail, and paste everything above the message body.
FAQ
Is my email sent anywhere when I paste the headers?
No. The analyzer runs entirely in your browser. Headers can include your address and internal server names, so it is worth using a tool that keeps them on your device.
Why are some hops missing times or IP addresses?
Servers write Received lines in slightly different formats and some internal hops leave details out. The analyzer shows what each line contains, and the outermost hops added by your own provider are the most trustworthy.
Can a sender fake the headers?
The sender can add fake Received lines below the real ones, but cannot change the lines added by your own provider at the top. That is why the Authentication-Results header from your provider is the one to trust.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
SPF Record Generator
Build an SPF record from the email services you actually use.
DMARC Record Generator
Build a DMARC record with the right policy and report addresses.
DMARC Report Viewer
Turn a DMARC aggregate XML report into a readable table.
Email Validator
Check a list of email addresses for syntax errors and likely typos.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.