The Email Stack Scan a domain
← Tools and reports

EML Viewer

/eml

Open any .eml or .mbox in your browser. See the message, every header, who really sent it, and whether it is safe. Nothing is uploaded.

Files are parsed in your browser and never uploaded. Only domains and IPs are looked up in public DNS for the Authentication tab.

What an .eml file holds

  1. What it is

    An .eml is the message exactly as it travelled: every header, the body, the attachments.

  2. Why it matters

    It shows who really sent it, which servers touched it, and whether the signature still verifies.

  3. Without it

    You only see what the mail client chose to show you.

What you can see

  • The message as it was sent, rendered in a sandbox: scripts are stripped, remote images are blocked until you ask for them, and every link opens in a new tab.
  • Who really sent it: the receiver's SPF, DKIM and DMARC verdicts, the DKIM signature re-verified against the key in DNS right now, and whether the domains align with the From address.
  • Where it came from: every server it passed through with the delay at each hop, the sending IP's reverse DNS, and a check against public blocklists.
  • What is inside: every header decoded, every link with tracking and look-alike destinations flagged, attachments with safety flags, calendar invites read out.
  • A Message Report you can print or save as PDF, and a standalone HTML copy of the message.

Common questions

How do I get an .eml from Gmail?

Open the message, click the three-dot menu (⋮) at the top right of the message and choose Download message. Show original on the same menu shows the raw source, which you can copy and paste here instead.

And from Outlook or Apple Mail?

In Outlook, drag the message from the list to your desktop, or use File → Save As and pick the .eml (or "Outlook Message Format – Unicode" for .msg, which this viewer cannot read yet). In Apple Mail, select the message and choose File → Save As… with the format set to Raw Message Source.

Is anything uploaded?

No. The file is read and parsed in your browser and never leaves it. The only network requests are DNS lookups over HTTPS for the Authentication tab: the DKIM key, the DMARC record, the sending IP's reverse DNS and the blocklists. Remote images in the message are not fetched unless you click "Load images".

What about .msg files?

Not yet. Outlook's .msg is a different, binary format (OLE compound file), not the RFC 822 message this viewer reads. Export the message as .eml from Outlook, or forward it as an attachment to a mailbox you can download from.

Why can the DKIM re-check differ from the receiver's verdict?

The receiver checked the signature at delivery time. We check it again now, in your browser, against whatever key is in DNS today. If the sender rotated the key since, or the message was modified after delivery (a mailing list footer, a forwarded copy), the re-check fails even though the original verdict was pass. Both are shown so you can tell the two apart.