What is "email header analysis tool"? How to safely investigate the source and delivery route of suspicious emails

§1. I sympathize with this concern: Is the email I received really real? Or is it spoofing?

"I received an important email from a business partner, but the sender address seems a little different than usual..."

"The notification email from the system arrived hours late, but I would like to find out which server caused the delay..."

“I want to identify the real source (IP address) of suspicious spam emails and take measures such as blocking them.”

Have you ever felt doubts or concerns about business or daily email exchanges?

The "From" displayed on the email software screen can actually be easily spoofed. It is difficult to accurately determine whether an email is genuine or spoofed'' by a malicious third party just by looking at the sender information.

In order to solve this problem and find out the true identity of the email, it is essential to analyze the email header (EML/Raw source).

§2. Explanation of the cause: Important information that can be read from email headers and the analysis mechanism

An email header is "delivery tracking record and control information" that is added separately from the email body. It is like a collection of postmarks and relay station stickers affixed to mail items, and contains very important information such as the following.

① Received header (delivery route and delay history)

The history of all mail servers that an email passes through from the sender's terminal to the recipient's mail server is recorded along with the time of passage.

By tracing this record in order from oldest to oldest, you can find out the "true source IP address" of the email and the "delivery delay time (lag)" between relay servers.

② Security authentication result (SPF / DKIM / DMARC)

Modern email is equipped with three typical authentication technologies to prevent spoofing.

• SPF (Sender Policy Framework): Verifies whether the source IP address is authorized by the owner of the source domain.
• DKIM (DomainKeys Identified Mail): Verifies that the electronic signature attached to the email has not been tampered with during transmission.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Instructs the recipient how to handle emails that fail SPF or DKIM verification, and strengthens the authentication results.

“Security risks” when using online analysis tools

E-mail headers contain a lot of sensitive information, such as the sender's and recipient's e-mail addresses, names, IP addresses within the organization, and server names used.

If you paste email header text into a general free online analysis tool, there is a risk that such private data will be sent and stored on the developer's external server, which could lead to the leak of internal information or business partner information.

§3. Tool-based solutions: Secure and detailed visualization with ZeroTools email header analysis tool

“I want to easily check delivery routes and certification status without taking security risks and without specialized knowledge.”

Our site's Email header analysis tool (EML file parsing) meets these needs.

This tool does not send any read email header text or EML files to an external server. All analysis processing is performed using only JavaScript on your device (browser), so you can investigate highly confidential email information in a completely offline and safe environment.

Information obtained from analysis tools and how to use them

1. Open the Email header analysis tool (EML file parsing) page.

2. Paste the raw source (header text) copied from your email software (Outlook, Gmail, Thunderbird, etc.) or drag and drop the saved EML file.

3. The analysis will be completed at the same time as loading, and the following information will be displayed graphically.

• Security Certification Status: You can tell at a glance whether the verification results for SPF, DKIM, and DMARC are "PASS" using icons and color coding.
• Visual delivery route: The servers passed through are visualized in a timeline format, allowing you to see at a glance how many seconds and minutes of delivery delays occurred at which relay points.
• Header list search function: You can instantly search and filter specific keywords or header names (e.g. Subject, X-Spam, etc.) from hundreds of lines of raw headers.

Please make use of ZeroTools' email header analysis tool, which operates completely locally and thoroughly protects privacy, for business email investigations and internal security audits where safety is of utmost importance.