Email Header Analyzer
Paste an email's raw headers and trace its delivery: the Received: hop chain (from → by) with the delay at each hop, the authentication results (SPF / DKIM / DMARC), and the key headers. Raw headers name real internal hosts, IP addresses, and recipients, so the analyzer is gated behind a short acknowledgement.
This is generated in browser and is not sent to pah.moi servers.
About this tool3 paragraphs
The Received: chain is shown oldest first, which is the reverse of the order it sits in the file, and each hop's time is taken from after the last semicolon at comment depth zero so a comment carrying its own semicolon cannot steal it. Consecutive times give the delay at each hop; a hop that appears to arrive before the one that sent it is labelled clock skew rather than printed as a negative delay, because badly-set clocks are ordinary and a negative number reads like a finding.
SPF, DKIM and DMARC are graded in three tiers, not pass against everything. softfail, neutral, none and temperror are a middle band of their own, and a mechanism that is absent is reported as not present instead of quietly disappearing from the list. Each verdict says its own word and carries a plain-language explanation, reachable by keyboard as well as by pointer.
Every header here is self-reported by the servers that wrote it. A hop chain is evidence, not proof: anything below the first host you have an independent reason to trust can be forged wholesale, and the authentication line is the receiving server's conclusion rather than a check this page performs. Nothing is looked up while you read: no DNS query goes out to confirm an SPF record or fetch a DKIM key, and there is no message body, no attachment and no link analysis here.
email-headers-cli from the site's source with:
cargo build --release --bin email-headers-cliSource and licence terms