No. Header parsing and EML/text file reading are performed locally in your browser. The network tabs send only the domain, hostname or IP required for that specific diagnostic.
Analyze email headers privately in your browser, inspect sender authentication and routing, test mail ports and SMTP capabilities, check DNS email security records, and investigate IP blacklist status.
.eml / text file to inspect the message route, probable originating IP, SPF, DKIM, DMARC, ARC, TLS and spam-filter headers. Header parsing happens locally in your browser. Network-based checks use only safe PHP DNS, cURL/socket-style functions — no shell commands.Paste raw headers or load an .eml file. The analyzer unfolds headers and reads repeated Received and Authentication-Results fields.
Review SPF, DKIM and DMARC results, sender/return-path alignment, spam scores, source IP candidates and mail hops.
Test SMTP/IMAP/POP ports, email DNS records, SMTP capabilities and IP reputation using server-side native networking functions.
For best results use “Show original”, “View source”, or “View raw message” in your mail client.
| # | Server / From | IP addresses | Date / Detail |
|---|
Checks SMTP 25/465/587/2525, IMAP 143/993, POP3 110/995 and ManageSieve 4190 using native PHP sockets.
Checks selected DNS-based blocklists. Results depend on each list's access policy and your server resolver.
Checks MX, SPF, DMARC, TLS-RPT and an optional DKIM selector. Common selectors include selector1, selector2, google, default and vendor-specific names.
Connects only long enough to read the banner and issue a fixed EHLO. It does not authenticate, send mail, relay mail, or accept user-supplied SMTP commands.
Decode routing, probable source IP, authentication results, spam headers, sender alignment and transport clues entirely in your browser.
Inspect authentication results from a received message and separately check the domain's published email-security DNS records.
Test SMTP, submission, IMAP, POP3 and ManageSieve ports plus SMTP banners, EHLO capabilities and STARTTLS advertisement.
Query selected DNS blocklists to help investigate rejected or spam-foldered outbound mail while respecting provider access policies.
No. Header parsing and EML/text file reading are performed locally in your browser. The network tabs send only the domain, hostname or IP required for that specific diagnostic.
The tool examines the earliest Received hops for public IP addresses. Webmail, relays, gateways and forged headers can obscure the true sender, so it is shown as a probable source rather than absolute proof.
The analyzer reads authentication results already recorded by the receiving mail system. If those headers are missing, stripped or non-standard, the message alone may not contain enough evidence.
No. It reads the SMTP banner, sends only a fixed EHLO diagnostic command, reviews capabilities such as STARTTLS and AUTH, and then disconnects.