// tool reference · Incident & Response

Email Header Analyzer Free

生のメールヘッダーから SPF、DKIM、DMARC、配送経路を読み取り、なりすましを見つけます。

What it does

Parses raw email headers into a readable hop path with authentication results — the deterministic companion to the AI phishing analyzer.

When to use it

You want the mechanical facts about a message without an AI interpretation.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
ヘッダー	textarea	required	Raw headers (Show Original / View Source).

What you get back

Hop path with timing, auth results, and alignment findings.

活用例

Input

Received: from mail.evil.ru (mail.evil.ru [198.51.100.9])
  by mx.example.com; Thu, 17 Jul 2026 09:14:02 +0900
From: billing@trusted-vendor.com
Return-Path: bounce@evil.ru
Authentication-Results: mx.example.com; spf=fail; dkim=none; dmarc=fail

Output (abridged)

VERDICT: SPOOFED -- authentication failed on every check

HOP PATH
  1. mail.evil.ru (198.51.100.9) -> mx.example.com   09:14:02
     A single hop from a host claiming to be a vendor.

AUTHENTICATION
  SPF    fail  -- 198.51.100.9 is not authorised for evil.ru
  DKIM   none  -- unsigned
  DMARC  fail  -- alignment fails

ALIGNMENT
  From:        billing@trusted-vendor.com   <- what the user sees
  Return-Path: bounce@evil.ru               <- where it came from
  These do not match. The From header is free text; Return-Path is not.

  Everything the user sees is attacker-controlled. The headers are not.

How it works

Deterministic parsing. Offline — no AI, no lookups.

Limits

Read live from the platform configuration.

Rate limit

30 requests / 60s (platform default)

Limitations — what it does なし do

Headers can be forged, but Received chains are appended by each hop -- read them from the bottom up. It cannot verify a hop that lies about an upstream it invented.

プライバシー

Nothing is stored.

Standards

SPFDKIMDMARCRFC 5322