Paste, drag in, or upload full email headers (a .txt export, or
just the raw header block copied from your mail client's "show original"/"view source").
Extracts the common fields, walks every Received hop in true chronological
order (the raw file lists them newest-first — a classic thing to get backwards) with the
delay between each, flags private/RFC1918 IPs and sending-hostname mismatches, summarizes
SPF/DKIM/DMARC from Authentication-Results, and extracts every IP, domain,
URL, and email address found. Runs entirely in your browser: nothing is looked up (no DNS,
no reputation checks) and nothing is ever transmitted anywhere.
Common fields
Authentication
Received chain ( hops, chronological — origin first)
Extracted indicators
For deeper investigation (dedup, export, per-type
filtering), copy these into the Indicator Extractor.
Hostname-mismatch detection compares the claimed sending host (after from)
against the parenthetical name the receiving server observed, and only flags a genuine
mismatch when both are present and share no common domain suffix — it will never flag a
hop where only one name is available, since there's nothing to compare. This is a
heuristic, not proof of forgery: legitimate infrastructure occasionally has mismatched
naming too, especially behind load balancers or third-party mail relays.