Path · Auth · Live DNS · Red flags · Export
Paste headers and choose Analyze — results appear in tabs.
From left (sender) to right (inbox). Arrows show delay and protocol.
Hop locations from public GeoIP (lat/lon) on OpenStreetMap. GeoIP is approximate (data centers, anycast). Map is static (no zoom).
Vertical timeline with segments and duration between hops. Negative Δ indicates clock skew.
| # | From | By | IP | Scope | PTR (live) | Geo | Proto | Time | Δ |
|---|
Multiple AR headers = multiple checking systems. The top (newest) one is typically your receiving gateway — the trust boundary.
How From relates to SPF envelope domain and DKIM d= for this message.
Authenticated Received Chain — useful across mailing lists and forwards.