Security Intelligence

Email Analyzer

Upload a suspicious .eml file to instantly analyze email headers, verify SPF/DKIM/DMARC authentication, detect phishing indicators, and extract threat intelligence, all without exposing your inbox.

~ digitalchk / eml analyzer

Drag & drop an .eml file here or click to browse

Or paste raw email source

I accept the Terms & Conditions *

By using this Email Analysis Tool, you acknowledge and agree to the following: 1. Purpose: This tool analyzes email files (.eml) for security threats including phishing, spoofing, malware, and spam indicators. Results are provided for informational purposes only and do not constitute professional security advice. 2. Data Processing: Email content you submit is analyzed on our own server. The full analysis, including the message and its attachments, is kept for up to 2 hours, only to build the AI summary and the PDF report, and is then deleted automatically; after that nothing of the message is kept, except the lead data described below if you give us your email. If you request an AI-powered summary, the analysis data, including the text of the message and of any text attachments, is sent to a third-party AI service for processing. 3. Email Collection: Your email address may be requested to continue using the tool after the free analysis limit, to generate an AI summary, or to receive a PDF report. When provided, your email address will be stored as a lead along with analysis metadata (sender, subject, threat score). Your email address may be verified for validity using a third-party email verification service. Your IP address is recorded alongside it and used for rate limiting and abuse prevention. 4. No Guarantee: While we strive for accuracy, no automated analysis tool can detect all threats. Always exercise caution with suspicious emails regardless of the analysis results. 5. Privacy: We do not share your submitted email content with third parties, other than the AI service described above when you ask for a summary. Stored lead data is subject to automatic deletion based on our data retention policy. 6. Acceptable Use: This tool is intended for legitimate security analysis. Do not submit emails containing illegal content or use results for malicious purposes. 7. Liability: We are not liable for any damages arising from reliance on the analysis results provided by this tool. Daily limit: past the daily limit of free uses, you will be asked for your email address and a 6-digit code we send to it. Free uses are counted per IP address, stored as a hash, for the day, and only an address confirmed with the code is kept as a contact. The AI summary asks for the same code from the first use.

A tool by Digital Checkmark

How to Use

Export the email: In your email client (Gmail, Outlook, Thunderbird), save or export the email as a .eml file. In Gmail, click the three dots → “Download message”.
Upload or paste: Drag the .eml file into the upload zone above, or click to browse. Alternatively, open the file in a text editor, copy the raw content, and paste it.
Analyze: Click “Analyze Email” and wait for the results. The analysis inspects headers, authentication records, embedded URLs, IP addresses, and attachments.
Review results: Check the authentication status (SPF, DKIM, DMARC), inspect any IOCs, and review attachment details for potential threats.

What is EML Analysis?

EML (Electronic Mail) analysis is the process of examining the full source of an email message to identify security threats, verify sender authenticity, and extract indicators of compromise (IOCs). Unlike viewing an email in a mail client, EML analysis inspects the complete message including:

Email Headers: The routing path, server hops, and timestamps that reveal the true origin of the message.
Authentication Results: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication) checks that verify the sender is legitimate.
Indicators of Compromise: Suspicious IP addresses, URLs, domains, and email addresses embedded in the message that may link to phishing, malware, or command-and-control infrastructure.
Attachments: File names, types, sizes, and cryptographic hashes (MD5, SHA-256) of attached files that can be cross-referenced with threat intelligence databases.
SpamAssassin Scoring: A score indicating the likelihood that the email is spam, based on hundreds of pattern-matching rules.

EML analysis is essential for incident response, phishing investigations, and email security auditing. Security professionals use it to determine whether an email is malicious before taking action.

We keep building free tools

Be the first to know when we launch a new one, plus practical tips to get more out of them. No spam.