email-headers

Email Header Forensics Lab is a desktop application for inspecting, generating, editing, and analyzing email headers in controlled environments for forensic analysis, security research, and authentication testing.

Paste email headers, read in one sentence why SPF, DKIM, or DMARC failed and what to fix. Runs entirely in the browser. Beta.

Local-first tool for checking suspicious IP addresses, URLs, DMARC reports and e-mails, and for preparing AbuseIPDB reports. Runs only on your own computer, explains every result in plain language, computes security facts in code and uses an LLM only as an optional helper. English and Polish.

Analyze email headers locally: delivery hops, delays, SPF DKIM DMARC verdicts and a redacted ticket-safe report from raw headers or an .eml file.

Offline audit of captured email recipient headers against explicit routing policies. Independently built by Nakaryu GmbH.

Free online email header analyzer: paste raw email headers to trace the delivery path (Received chain), compare From, Return-Path and Reply-To for spoofing red flags, and read SPF, DKIM and DMARC results in plain language. Anti-phishing defense tool — 100% private, runs in your browser.

Reads the headers of a suspicious email and shows who really sent it — the address you see against the envelope it actually came from. Every finding quotes the header line behind it. Runs entirely in your browser; nothing is uploaded.

An open, community-maintained filter list that identifies cold-outreach sending platforms (Instantly, Smartlead, Apollo, and more) from email headers. EasyList, but for cold email.

Local reported-header inspection for SPF, DKIM and DMARC. Unverified by default. Does not validate messages or detect phishing.

Email header analysis made easy!

Private, browser-only inspector for JWTs, certificates, SAML, email and security headers, IDs and encodings. Built by swiss.software.

Explain SPF, DKIM and DMARC results and the delivery route from raw email headers - without flagging legitimate newsletters as suspicious.

Free MCP server for security operations: CVSS 3.1 scoring, IOC extraction and defanging, email header triage, hash and JWT decoding, timestamps, layered decoding, CISA KEV lookup. No account, no telemetry.

メールヘッダーを安全にデコードし、フィッシング・なりすましの兆候をオフラインで解析するデスクトップツール (PySide6)

Python CLI that reads one .eml file and produces one JSON verdict. 46 explainable rules, weights calibrated on seven measured samples, standard library only. Reads the SPF/DKIM/DMARC verdicts already reported by the receiving mail system — it does not verify them. Measured results published in full, including the false negatives..

Plain English guide to reading email headers, with sample files

This case study presents a social engineering attack using a shortened URL embedded in a phishing email. The email, crafted to impersonate internal IT support, urged the user to “update their credentials” by clicking a masked bit.ly link.

Offline email header analysis for Node.js and the browser: Received chain, SPF/DKIM/DMARC/ARC, Authentication-Results trust, anomalies. Zero dependencies.

Inspect, generate, and test email headers in a desktop app for forensic review, delivery chain analysis, and authentication checks