Email (.eml) Analyzer

About this tool

A phishing email usually gives itself away in details that mail apps hide: the real sender address, a different reply address, a link that shows one web address and goes to another, a domain with look-alike letters, or an attachment that is really a program. This tool reads the complete source of a message (an .eml file, or the text from Show original or View source) and lays those details out. It reads the MIME structure with the open-source postal-mime library and then checks: whether the From domain matches the Return-Path and Reply-To domains, display names that carry another address or domain, the SPF, DKIM and DMARC verdicts written in the topmost Authentication-Results header (these are only as trustworthy as the server that wrote them: a forged header looks identical), the chain of servers in the Received headers with their IP addresses, unusual or mixed-alphabet characters in the subject and sender name, every link in the HTML and text parts (text that shows a different domain than the destination, user names before the @ that fake a host, raw IP addresses, punycode names with their Unicode form, link shorteners, javascript: links), and every attachment with its size, SHA-256 hash, detected real type and warnings for double extensions, programs, macro-enabled Office files, HTML attachments and names that do not match the content. Indicators (links, domains, IPs, addresses and hashes) are listed defanged, like hxxps://evil[.]example, so you can paste them into a report or chat without creating a clickable link. Nothing is uploaded, links are never opened and attachments are never run. The parser output was compared with Python's email package on test messages. These are signals, not verdicts: a legitimate mailing service can also trigger some of them, and a clean result does not prove a message is safe.

How to use it

1. Save the message as .eml, or open its source (Show original in Gmail, View source in Thunderbird) and copy it.
2. Drop the file or paste the source. Make sure the headers are included.
3. Read the problems and warnings first, then the sender details, links and attachments.
4. Copy the defanged indicators into your report, or hand them to your security team.

Common problems

It says there is no Authentication-Results header

That header is added by the receiving server and may be missing from a forwarded copy or an export. Check the sender domain with the email authentication checker instead.

A normal newsletter shows warnings

Mailing services send on behalf of a company, so the Return-Path domain and DKIM domain often differ from the visible From domain. Treat that as a hint, together with the other signals.

Can opening the .eml here infect me?

The message is only read as text. Links are not opened and attachments are not run, but never open an attachment or link you do not trust in any other tool.