EML Analyzer
Inspect email headers, recorded delivery times and stored authentication results. Review observations alongside the source records, entirely in your browser.
Drop your EML file here
Open one email to inspect its headers and recorded delivery path.
.eml files up to 25 MB · No upload requiredOpening your email…
How to analyze an EML file
Use this EML header analyzer when you need to understand the information stored in a saved email. It reports a limited set of header observations and a delivery timeline. These can help you investigate an export, but they do not establish who sent it or whether it was modified.
- Open a complete .eml message or the fictional sample.
- Review the observations, recorded authentication and delivery hops alongside their source headers.
- Download the JSON report, or switch to Headers to inspect the stored records in context.
Which header checks are included?
A finding describes the supplied file. Incomplete exports, drafts, unusual software and server clock differences can explain some observations. Read the raw header value before drawing a conclusion. A message with no reported inconsistency has only passed these limited checks; it has not been authenticated.
Header inspection is bounded. If the header block exceeds the inspection limit, the analyzer marks the result incomplete. A field absent from that excerpt may still occur later in the original message. The tool does not silently treat a partial inspection as a complete report.
| Check | What the observation means |
|---|---|
| Missing From or Date | The inspected header block does not contain that field. |
| Repeated key headers | From, Date, Subject or Message-ID occurs more than once. |
| Unreadable date | A date cannot be normalized with a supported explicit timezone. |
| Backward hop time | A Received timestamp is earlier than the previous recorded hop. |
| Missing delivery trace | No Received records were found in the inspected headers. |
Read a Received-header example
Mail servers normally add each new Received field above the earlier ones. The sample below contains the fictional delivery records from the built-in EML. Read the bottom line first to follow the stored sequence.
Fictional headers from studio-visit.eml
Received: from relay.example.com by inbox.example.com;
Sat, 10 Oct 2026 09:30:08 +0000
Received: from sender.example.com by relay.example.com;
Sat, 10 Oct 2026 09:30:02 +0000The analyzer preserves bottom-to-top header order instead of sorting by timestamp. It calculates a delay only when both adjacent dates can be read. A missing or unsupported date leaves the interval unavailable; it does not justify filling in a time from a neighboring record.
A negative interval can result from clocks that disagree. It can also occur in edited or exported headers. Inspect both records and their timezones before treating the difference as evidence of a delivery problem. The six-second example illustrates the calculation, not verified real-world transport.
Recorded authentication is not live verification
Authentication-Results can contain stored SPF, DKIM and DMARC outcomes. EMLKit displays that text and counts DKIM-Signature fields, but it does not query DNS, retrieve signing keys or cryptographically verify a signature. A recorded pass is an unverified statement inside the supplied email.
The file alone does not establish which receiving server you trust. Headers can be copied or changed, so an authentication label must be evaluated with the original message source and the relevant mail system. This page provides no genuine/fake score, sender location or identity verdict.
What is in the JSON report?
The report contains inspected header fields, observations, the recorded hop sequence and any readable normalized timestamps. It also includes stored authentication values and the signature-header count. Keep the original EML if someone else needs to reproduce or expand the analysis.
For nested parts, charsets and transfer encodings, use MIME structure viewer. To read the message or save its attached files, use the Email and Attachments tabs on this page.
EML header analysis questions
Can this detect a fake or edited email?
It can highlight certain inconsistencies, but it cannot determine authenticity. Headers can be edited, and clock differences or export omissions can explain anomalies. No confidence score or genuine/fake verdict is produced.
Does this verify DKIM, SPF, or DMARC?
No. It displays Authentication-Results values stored in the file and counts DKIM-Signature headers. It does not fetch DNS keys, verify signatures, or establish a trusted receiving-server boundary. Even a recorded pass is an unverified claim here.
How is the delivery timeline ordered?
Received headers are normally prepended. The tool reads them from bottom to top as the recorded delivery sequence, without sorting by date. It calculates delays only between adjacent records whose explicit timezone and date it can read.
Why is a hop date unavailable?
The date may be missing, malformed, use an unsupported timezone notation, or fall outside the inspected header excerpt. The raw record is retained so you can inspect it yourself.
Does the analyzer find the sender’s location?
No. Server names and IP-like text may appear in the raw delivery records, but this tool performs no geolocation or identity lookup. Server information does not establish the human sender’s location.
Does my data leave my device?
Your selected files and pasted text are processed in your browser, without being uploaded to EMLKit. Remove the input or leave the page to clear the current workspace. Ordinary page requests still reach the site host. Read about file handling.