📧 Email Header Analyzer

📧 Email Headers

💡 Tip: Copy raw email headers from your email client (View Source/Show Original)

⚙️ Analysis Options

Show all parsed headers Show technical routing details Highlight security issues

💡 Example Headers

📊 Analysis Summary

Total Headers: {{ analysis.summary.total_headers }}

Routing Hops: {{ analysis.summary.routing_hops }}

Authentication Status: {{ analysis.summary.authentication_status.toUpperCase() }}

Recommendations:

{{ rec }}

📄 Basic Information

From: {{ analysis.basic_info.from }}

To: {{ analysis.basic_info.to }}

Subject: {{ analysis.basic_info.subject }}

Date: {{ analysis.basic_info.parsed_date }}

Message ID: {{ analysis.basic_info.message_id }}

🔐 Authentication Results

SPF: {{ analysis.authentication.spf.result.toUpperCase() }}

DKIM: {{ analysis.authentication.dkim.result.toUpperCase() }}

DMARC: {{ analysis.authentication.dmarc.result.toUpperCase() }}

Issues Found:

⚠️ {{ issue.message }}

🗺️ Routing Information

Delivery Time: {{ analysis.routing.delivery_time_formatted }}

Routing Path ({{ analysis.routing.path.length }} hops):

From: {{ hop.from }}

By: {{ hop.by }}

With: {{ hop.with }}

🚨 Spam Analysis

Risk Level: {{ analysis.spam_indicators.risk_level.toUpperCase() }}

Spam Score: {{ analysis.spam_indicators.score }}

🔍 All Parsed Headers

{{ formatHeaders(analysis.headers) }}

⚠️ {{ error }}

ℹ️ About Email Header Analyzer

Email header analysis parses the raw metadata that mail systems add before the message body: address fields, timestamps, Message-ID, Received trace lines, Authentication-Results, content type, mailing-list markers, and spam-scoring headers. Those fields help explain where a message came from, which servers handled it, whether SPF/DKIM/DMARC passed, and which details deserve closer investigation.

Useful investigations:

Phishing triage: compare the visible From, Reply-To, sending host, and domain authentication results.
Delivery troubleshooting: inspect each Received hop, SMTP protocol label, timestamp, and total routing delay.
Domain authentication review: summarize SPF, DKIM, and DMARC pass/fail results reported by the receiving mail server.
Bulk-mail identification: flag List-Unsubscribe, Precedence, and spam-score headers when they are present.
MIME and attachment clues: detect multipart content types and boundaries that may indicate attachments or complex message bodies.

Authentication signals: SPF checks whether the sending host is authorized for the envelope domain, DKIM verifies a cryptographic signature tied to a signing domain, and DMARC evaluates alignment with the visible From domain. This analyzer reads those results from Authentication-Results; it does not perform live DNS lookups or independently recompute DKIM signatures.

Example signals:

Authentication-Results: mx.example.net; spf=pass ...; dkim=pass ...; dmarc=pass ... usually means the receiver saw aligned, authenticated mail.
spf=fail, dkim=fail, or dmarc=fail on an unexpected sender is a strong reason to inspect the message and links before trusting it.
Many old, private, or inconsistent Received timestamps can reveal forwarding loops, delayed relays, or headers inserted before the first trusted gateway.

Limitations and privacy: headers can be forged before they reach a trusted mail server, and the safest interpretation usually starts from the receiving system you control and works backward through the trace. Raw headers can expose email addresses, IP addresses, internal hostnames, message IDs, and mailing-list metadata. Redact sensitive values before sharing results, especially when using the API endpoint instead of the in-browser analyzer.

Message format: RFC 5322 defines Internet message headers and trace fields.
SMTP trace: RFC 5321 describes SMTP delivery and trace information.
Authentication results: RFC 8601 defines the Authentication-Results header.
Email authentication: RFC 7208 covers SPF, RFC 6376 covers DKIM, and RFC 7489 covers DMARC.
MIME and lists: RFC 2045 defines MIME message body structure, and RFC 2369 defines mailing-list command headers such as List-Unsubscribe.

How to get headers: most email clients expose raw headers through labels such as "Show original", "View source", "View message details", or "Download message". Paste the header block above the blank line that separates headers from the message body.

API Usage Example:

POST /api/tools/osint/email-headers
Content-Type: application/json

{
    "headers": "From: [email protected]\nTo: [email protected]\nSubject: Investigation\nAuthentication-Results: mx.example.net; spf=pass smtp.mailfrom=example.com; dkim=pass header.d=example.com; dmarc=pass header.from=example.com"
}