Email Header Analyzer
Paste an email's raw headers and trace its delivery: the Received: hop chain (from → by) with the delay at each hop, the authentication results (SPF / DKIM / DMARC), and the key headers. Raw headers name real internal hosts, IP addresses, and recipients, so the analyzer is gated behind a short acknowledgement.
This is generated in browser and is not sent to pah.moi servers.
About this tool3 paragraphs
The Received: chain is shown oldest first, which is the reverse of the order it sits in the file, and each hop's time is read from the end of the line, ignoring semicolons that sit inside a comment. Consecutive times give the delay at each hop. When a hop appears to arrive before the one that sent it, that is labelled clock skew instead of a negative delay, because badly-set clocks are common and not usually a problem.
SPF, DKIM and DMARC get three grades, not just pass or fail. softfail, neutral, none and temperror are a middle band of their own, and a mechanism that is absent is reported as not present instead of quietly disappearing from the list. Each verdict says its own word and carries a plain-language explanation, reachable by keyboard as well as by pointer.
Every header here is self-reported by the servers that wrote it. A hop chain is evidence, not proof: anything below the first host you have an independent reason to trust can be forged wholesale, and the authentication line is the receiving server's conclusion rather than a check this page performs. Nothing is looked up while you read: no DNS query goes out to confirm an SPF record or fetch a DKIM key, and there is no message body, no attachment and no link analysis here.
email-headers-cli from the site's source with:
cargo build --release --bin email-headers-cliSource and licence terms