EML Analyzer

Return-Path: <bounce@mailer.example>
Received: from mx.example.org (localhost [127.0.0.1])
	by mx.example.org (Postfix) with ESMTP id 4QxYz1; Mon, 19 Oct 2026 09:15:07 +0000
Authentication-Results: mx.example.org; spf=softfail smtp.mailfrom=bounce@mailer.example;
	dkim=pass header.d=mailer.example header.s=s1; dmarc=fail header.from=account-check.example
Received: from smtp.mailer.example (smtp.mailer.example [203.0.113.45])
	by mx.example.org (Postfix) with ESMTPS id 4QxYz1; Mon, 19 Oct 2026 09:15:05 +0000
Received: from [192.168.10.20] (unknown [198.51.100.23])
	by smtp.mailer.example (Postfix) with ESMTPSA id 9A8B7C; Mon, 19 Oct 2026 09:14:58 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=mailer.example; s=s1; h=from:to:subject; bh=AAAA; b=BBBB
From: "support@example.com" <alerts@account-check.example>
Reply-To: billing@example.net
To: user@example.org
Subject: Action required: verify your account
Date: Mon, 19 Oct 2026 09:14:57 +0000
Message-ID: <4471@mailer.example>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="b1"

--b1
Content-Type: text/html; charset=utf-8

<p>Your account will be suspended. Verify it here:
<a href="https://login.example.net/verify">https://www.example.com/account</a></p>
--b1
Content-Type: text/html; name="invoice.pdf.html"
Content-Disposition: attachment; filename="invoice.pdf.html"
Content-Transfer-Encoding: base64

PGZvcm0gYWN0aW9uPSJodHRwczovL2NvbGxlY3QuZXhhbXBsZS5uZXQvcG9zdCI+PGlucHV0IHR5cGU9InBhc3N3b3JkIiBuYW1lPSJwIj48L2Zvcm0+
--b1--

pasted source · 1.5 KB · 3 MIME parts · nothing left this browser

Summary
6 danger signs
Display name shows support[@]example[.]com but the real sender address is alerts[@]account-check[.]example
DMARC fail (reported by mx[.]example[.]org): the From domain did not authenticate this message
attachment invoice.pdf.html contains a form with a password field
Link text shows www[.]example[.]com but the link goes to login[.]example[.]net
Attachment "invoice.pdf.html": double extension: looks like .pdf but is .html
Attachment "invoice.pdf.html": .html opens in a browser: a common way to deliver fake login pages
2 warnings
Replies go to billing[@]example[.]net, a different domain than the sender (account-check[.]example)
SPF softfail (reported by mx[.]example[.]org) for bounce[@]mailer[.]example
2 notes
Return-Path domain mailer[.]example differs from the From domain: SPF does not cover account-check[.]example (normal for bulk-mail services)
No DKIM signature from account-check[.]example (signed by mailer[.]example): DKIM is not aligned
Sender and key headers
FROM	support[@]example[.]com <alerts[@]account-check[.]example>
REPLY-TO	<billing[@]example[.]net>
RETURN-PATH	<bounce[@]mailer[.]example>
TO	<user[@]example[.]org>
SUBJECT	Action required: verify your account
DATE	Mon, 19 Oct 2026 09:14:57 +0000 (2026-10-19 09:14:57 UTC)
MESSAGE-ID	<4471[@]mailer[.]example>
Domains compared with the From domain

From domain: account-check[.]example. DMARC passes only when SPF (Return-Path) or DKIM (d=) is from the same organization.

HEADER	DOMAIN	COMPARED WITH FROM
Reply-To	example[.]net
…