# EML Analyzer

URL: https://phishdestroy.io/developer-tools/eml-analyzer
Category: Email
Where it runs: Runs locally (nothing you enter is uploaded)

Drop a .eml file or paste a message source to check its sender headers, Received chain, links and attachments. It all runs in your browser.

## Example input

Crafted phishing message

```
Return-Path: <bounce@mailer.example>
Received: from mx.example.org (localhost [127.0.0.1])
	by mx.example.org (Postfix) with ESMTP id 4QxYz1; Mon, 19 Oct 2026 09:15:07 +0000
Authentication-Results: mx.example.org; spf=softfail smtp.mailfrom=bounce@mailer.example;
	dkim=pass header.d=mailer.example header.s=s1; dmarc=fail header.from=account-check.example
Received: from smtp.mailer.example (smtp.mailer.example [203.0.113.45])
	by mx.example.org (Postfix) with ESMTPS id 4QxYz1; Mon, 19 Oct 2026 09:15:05 +0000
Received: from [192.168.10.20] (unknown [198.51.100.23])
	by smtp.mailer.example (Postfix) with ESMTPSA id 9A8B7C; Mon, 19 Oct 2026 09:14:58 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=mailer.example; s=s1; h=from:to:subject; bh=AAAA; b=BBBB
From: "support@example.com" <alerts@account-check.example>
Reply-To: billing@example.net
To: user@example.org
Subject: Action required: verify your account
Date: Mon, 19 Oct 2026 09:14:57 +0000
Message-ID: <4471@mailer.example>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="b1"

--b1
Content-Type: text/html; charset=utf-8

<p>Your account will be suspended. Verify it here:
<a href="https://login.example.net/verify">https://www.example.com/account</a></p>
--b1
Content-Type: text/html; name="invoice.pdf.html"
Content-Disposition: attachment; filename="invoice.pdf.html"
Content-Transfer-Encoding: base64

PGZvcm0gYWN0aW9uPSJodHRwczovL2NvbGxlY3QuZXhhbXBsZS5uZXQvcG9zdCI+PGlucHV0IHR5cGU9InBhc3N3b3JkIiBuYW1lPSJwIj48L2Zvcm0+
--b1--

```

A display name posing as support@example.com, Reply-To and DKIM on other domains, DMARC fail, a link whose text shows www.example.com but goes to login.example.net, and an invoice.pdf.html attachment with a password form.

## FAQ

### What does the EML Analyzer check?

It decodes the headers and every MIME part, compares the From, Reply-To, Return-Path, DKIM d= and Message-ID domains, and reads the Authentication-Results. It also lists the Received hops with their delays, every link with its visible text, and the SHA-256, SHA-1 and MD5 of each attachment.

### Can it prove that an email is phishing, or that it is safe?

No. It shows facts and warning signs, not a verdict: legitimate bulk mail often has a different Return-Path or DKIM domain, and DKIM signatures are listed but not cryptographically verified. Outlook .msg files are not supported; save the message as .eml first.

### Is the email uploaded anywhere?

No. The file is read and parsed in your browser, the HTML is shown as text and never rendered, and nothing goes over the network. The Send to button passes a result to another tool page through your browser's session storage.

## Related tools

- [Email Authentication Checker](https://phishdestroy.io/developer-tools/email-auth-checker)
- [Email Header Parser](https://phishdestroy.io/developer-tools/email-header-parser)
- [Link Unwrapper](https://phishdestroy.io/developer-tools/link-unwrapper)
- [HTML Attachment Analyzer](https://phishdestroy.io/developer-tools/html-attachment-analyzer)
- [File Hash Calculator](https://phishdestroy.io/developer-tools/file-hash)
- [IOC Converter](https://phishdestroy.io/developer-tools/ioc-converter)

All tools: https://phishdestroy.io/developer-tools