OSINT · Email Intelligence
SOC-grade email header analysis. Composite authentication scoring, BEC indicator detection, hop-by-hop delay anomaly analysis, IP enrichment with RBL checks, and Microsoft Exchange header intelligence — analyzed server-side and never stored.
Paste raw email headers
In Outlook: File → Properties → Internet headers. In Gmail: ⋮ → Show original → Copy to clipboard.
SPF, DKIM, and DMARC results are parsed and scored into a 0–100 composite trust score. Detects alignment bypasses where SPF passes but the envelope domain doesn't match the From: header — a classic BEC indicator.
Flags Reply-To redirection to a different domain, Return-Path envelope mismatches, display name spoofing where the visible name implies a different sender, and lookalike domain similarity scoring.
Each Received: hop is timestamped and visualized chronologically. Delays > 60 minutes flag potential hold-and-release delivery (a spam evasion technique). Forged Date headers and out-of-order hop sequences are also caught.
Sending IPs are geolocated with ASN and hosting provider classification (cloud VPS vs. residential ISP vs. corporate). Real-time blocklist checks run across 5 major RBLs via DNS-over-HTTPS — no API keys required.
Parses X-MS-Exchange-Organization-SCL/PCL/BCL (Spam, Phishing, Bulk Confidence Levels), X-Forefront-Antispam-Report category codes, X-Originating-IP leaks, and X-PHP-Originating-Script indicators — all surfaced in plain English.
Decodes internationalized "xn--" punycode domains to their Unicode form and flags mixed-script and confusable characters — such as a Cyrillic "а" standing in for ASCII "a" — across the From, Reply-To, and Return-Path domains. Catches homograph lookalikes that visually clone a trusted domain.
Parses the raw DKIM-Signature header — not just the pass/fail — to expose the l= body-length limit (a signature-bypass vector), SHA-1 weak algorithms, expired signatures, and a From header left outside the signed set. Evaluates the ARC chain's cv= result for broken forwarder trust.
Scores the Subject line against BEC/phishing lexicons — urgency, financial, gift-card, credential, and secrecy language — and flags executable or double-extension attachment names (e.g. invoice.pdf.exe). Bulk-mail markers separate marketing blasts from targeted 1:1 lures.
A dedicated IOC panel harvests sending IPs, domains, sender addresses, URLs, DKIM selectors, and the Message-ID — with a one-click defang toggle for safe sharing. Export everything as JSON, CSV, or a Markdown incident summary, with findings mapped to MITRE ATT&CK techniques for SIEM and ticket workflows.
Privacy & Responsible Use: Your raw email headers are parsed entirely in your browser and never leave your device. The only data sent to TheAdminStack servers is a small set of anonymized boolean flags (e.g. whether SPF passed) used to compute the trust score — no header content, subjects, sender addresses, or IP addresses are transmitted, logged, or stored. IP geolocation and blocklist (RBL) checks are performed directly from your browser via ipapi.co and Cloudflare DNS-over-HTTPS. Use this tool only on email you have lawful authority to analyze.
Paste the full raw headers from a suspicious message. The analyzer scores SPF, DKIM, and DMARC results, flags Business Email Compromise indicators (display-name spoofing, reply-to mismatch, lookalike sending domains), maps every relay hop with timing anomalies, and enriches the originating IP against blocklists — giving you a SOC-grade verdict in seconds.
In Outlook: open the message, File > Properties > Internet headers. In Gmail: open the message, three-dot menu > Show original. In Apple Mail: View > Message > Raw Source. Copy everything and paste it in.
Yes. It is free with no account required. Header content is parsed entirely in your browser — the raw headers never leave your device. Only anonymized boolean flags (e.g. "SPF passed: yes/no") are sent to the scoring endpoint to compute the trust score, and nothing is stored or logged.
SPF verifies the sending IP is authorized for the domain, DKIM verifies the message was cryptographically signed and unaltered, and DMARC ties the two to the visible From address and sets a policy. The analyzer combines all three (plus ARC) into a single trust score so you can judge whether a message is likely legitimate or spoofed.
Yes. The analyzer decodes internationalized (IDN / "xn--" punycode) domains, detects mixed-script and confusable characters — for example Cyrillic letters that render like ASCII — and flags homoglyph impersonation of the From, Reply-To, or Return-Path domain. It also inspects the raw DKIM-Signature for body-length (l=) tampering limits, weak algorithms, and expiry, and extracts IOCs mapped to MITRE ATT&CK techniques.