~ digitalchk / docs / eml-analyzer
EML Analyzer takes an email file and tells you whether it is phishing, and why. It parses headers and authentication, extracts every indicator it can find, scores the result deterministically, and writes the reasoning out so a non-specialist can follow it.
How it works
Header and authentication analysis
SPF, DKIM and DMARC results, the received chain, and the mismatches between what a message claims and what it proves.
Indicator extraction
URLs, domains, addresses, IP addresses and attachments, including brand redirects unwrapped to their real destination, because a link that reads as google.com can carry a very different target in its parameters.
Deterministic score
A 0 to 100 threat score built from explicit rules rather than a model, so the same message always scores the same and every point is traceable to a rule. The score reads the sender, links and attachments, not what the message asks for, so the low band says “No technical red flags”, never “Safe”, and points the visitor to the AI summary. When the AI rates the content worse than the score, for example a scam sent from a real company account, a warning shows above the summary and in the emailed report and PDF.
Forwarded message handling
Detects when a message was forwarded and stops crediting the forwarder’s authentication results to the original sender, which is the failure mode that makes forwarded phishing look safe.
AI summary
An optional written explanation of the findings, clearly labeled as AI generated. It works with the built-in providers or any AI service with a Chat Completions API, with a thinking level for reasoning models and an optional backup endpoint that answers when the main one fails. When it is on, parts of the analysis (headers, findings and decoded text attachments) are sent to that provider; mention it in your privacy policy.
Requirements
- WordPress 5.8 or newer
- PHP 7.4 or newer
- A running eml_analyzer backend. It is an open source FastAPI service you self-host, normally as a container. Set its URL in Settings; on the same machine that is http://127.0.0.1:8000
Publishing it
Drop one of these shortcodes on any page or post. Each one is self-contained and needs no theme integration.
[eml_analyzer]
Attribution. The plugin shows a small “A tool by Digital Checkmark” line, with a link to digitalchk.com, under the analyzer, at the foot of the PDF report and under every email it sends. It is part of the plugin and has no setting to turn it off. If a tool and a Leads Chk form share a page, the line shows once.
Setup
Anti-abuse Recommended
Under Settings, add your Cloudflare Turnstile site key and secret key. Without it, anyone can script the public tool and consume your quotas on the outside services it uses.
With the keys in place, the plugin also refuses to email a verification code or a report unless the visitor recently passed a Turnstile check. A normal search counts; if not, a small check window opens before sending.
Email verification Recommended
The plugin verifies in three layers before sending a report: format, disposable domain, and, if you add a Reoon key, a real deliverability check. This protects your sending reputation from bounces to invented addresses.
PDF reports Optional
Reports are converted to PDF by Gotenberg, which you self-host. Set its URL in the reports tab; on the same machine that is http://127.0.0.1:3000. Without Gotenberg the rest of the plugin works unchanged.
Delivery and branding
Configure the SMTP server that sends the reports and the branding that appears on them: name, tagline, logo, colors and cover.
Notifications and contacts Optional
It can notify you by email or webhook when a lead arrives and, if you use Leads Chk, hand that lead to it, which keeps your contacts and your newsletter. Everything filters by event and by source, so you are not paged for noise.
Usage wall with a code Optional
Free uses are counted on the server, and you choose how many, so a private window does not reset them. Past the limit the visitor confirms an email address with a 6-digit code, and the tool unlocks for the rest of the day. Code requests and wrong attempts are limited, with a temporary lock. An address nobody verified is never saved as a lead.
Lead capture and retention
When somebody asks for their report, the plugin stores the address as a lead along with a summary of the result, and builds the report only from the result the server kept when the check ran (for up to 2 hours), so it always matches what the tool found. You will find these under Leads, and they export to CSV.
Retention is governed by GDPR Retention (days): leads older than that are deleted automatically by a scheduled task. Set it to 0 to disable the purge, though we would not recommend it. Declare in your privacy policy what you store and for how long.
The plugin also works with the WordPress privacy tools (Tools > Export Personal Data and Erase Personal Data): one request exports or deletes everything it keeps for an email address, together with the other Digital Checkmark plugins you have installed.
If Leads Chk is installed, every address the plugin collects through a report, the usage wall or the access gate is also sent there, with tags (the tool, how the address arrived, business or personal, and the result) and a consent record. What happens next (saved only, newsletter offered with a checkbox, or subscribed) and which list it goes to is decided in this plugin’s Integrations screen. Addresses that were only looked up, and could belong to someone else, stay out of Leads Chk. Leads Chk can also place a newsletter form under the tool.
If something does not work
Every analysis fails with a connection error.
Check that the backend answers at the URL configured in Settings. The plugin reports the failure rather than returning an empty analysis.
A scam scored 0 but the AI flagged it.
That is expected. A message sent from a real account (a hijacked mailbox, or a company support form abused to send it) passes SPF, DKIM and DMARC, so the technical score stays low. The AI reads the request itself, such as a recovery phrase, a payment or a password, and raises the verdict. From 3.7.0 the page shows a warning when that happens; the texts are under AI Analysis, Score and AI.
A forwarded phishing message scores as safe.
Update to 3.4.0 or newer. Earlier versions credited the forwarder’s authentication to the original sender.
Getting help
Write to us through the support page. Include your plugin version, your WordPress and PHP versions, and the exact text of any error.