MailScope — Email Header Analyzer

MailScope is a client-side email header analysis tool. Paste raw headers or drop .eml files and get a full breakdown of authentication, routing, security findings, and every header field — all processed in the browser with nothing sent to a server.

From the makers of Netra — enterprise DNS change management with approval workflows, drift detection, and audit trails for Windows DNS, Route 53, Cloud DNS, Azure DNS, and Cloudflare.

Features

• Email Summary — From, To, Subject, Date at a glance
• Security Alerts — SPF/DKIM/DMARC failures, Return-Path vs From mismatch, Reply-To mismatch, spam score detection, originating IP flagging
• Sender Authentication — SPF, DKIM, DMARC, and BIMI results with pass/fail/warn indicators
• Multiple DKIM Results — Shows all DKIM authentication results individually when multiple signatures are present (e.g., original sender + forwarding service)
• DKIM Signature Detail — Domain, selector, algorithm, canonicalization, signed headers, body hash
• DKIM DNS Lookup Hint — Shows the DNS record to query (selector._domainkey.domain) with a copy button for each DKIM signature
• ARC Chain — Full ARC-Seal / ARC-Message-Signature / ARC-Authentication-Results chain with per-hop validation status
• List-Unsubscribe Detection — Detects List-Unsubscribe and List-Unsubscribe-Post headers, shows RFC 8058 one-click support status, and lists all unsubscribe methods (mailto/http)
• Key Fields — Important metadata (Return-Path, Message-ID, X-Mailer, Content-Type, etc.)
• Routing Path — Hop-by-hop trace with per-hop delay detection and clickable IP geolocation links (ipinfo.io)
• Hop Delay Visualization — Visual bar chart showing relative delays across routing hops to quickly identify bottlenecks
• Timestamp Normalization — Toggle between Original, UTC, Local, and Relative timestamp display across all routing hops
• All Headers — Every header field sorted by priority with per-row copy buttons
• RFC 2047 Decoding — Encoded subjects and sender names are decoded for display
• Sample Headers — Load realistic example headers to see the tool in action before pasting your own
• Header Count & Size — Live line count and byte size indicator as you type or paste
• Bulk .eml Analysis — Drop multiple .eml files at once for a summary table with per-file auth results and drill-down
• Collapsible Cards — Click any section header to collapse/expand
• Collapse All / Expand All — Toggle all result cards at once
• Copy Everywhere — Per-section and per-field copy buttons throughout
• Export — Download a full analysis report as a text file
• Share — Copy a shareable URL with headers encoded in the URL fragment
• Drag & Drop — Drop single or multiple .eml files to auto-extract and analyze headers
• Paste Button — One-click paste from clipboard (mobile-friendly)
• Header Search — Filter the All Headers list by keyword
• IPv6 Support — Detects and looks up both IPv4 and IPv6 addresses in routing hops
• Total Transit Time — Shows total delivery time across all routing hops
• Keyboard Shortcut — ⌘/Ctrl + Enter to analyze
• Dark / Light / System theme toggle
• Mobile Responsive layout
• How-To Guides — Step-by-step instructions for Gmail, Outlook (Windows), Outlook (Mac), Outlook.com, Apple Mail, and Thunderbird

Running with Docker

docker compose up -d --build

The app will be available at http://localhost:8086. Rebuild after changes with the same command.

Project Structure

├── index.html              # Main HTML (markup only, no embedded CSS)
├── css/
│   ├── base.css            # Variables, themes, reset, layout, topbar, buttons
│   ├── components.css      # Cards, pills, auth, tables, hops, headers, alerts
│   └── features.css        # How-to, drag-drop, timestamps, delay viz, mobile
├── js/
│   ├── utils.js            # HTML escape, RFC 2047 decode, copy helpers, progress bar
│   ├── theme.js            # Dark/light/system theme toggle
│   ├── parsers.js          # Header parsing, auth, DKIM, ARC, List-Unsubscribe
│   ├── sample.js           # Sample headers data and load function
│   ├── render.js           # Analysis rendering, timestamp toggle, delay visualization
│   └── actions.js          # Navigation, drag-drop, export, share, IP lookup, bulk mode
├── nginx.conf              # Nginx site configuration
├── Dockerfile              # Multi-stage build — copies assets with correct ownership
├── docker-compose.yml      # Docker Compose service definition
├── .dockerignore           # Build context exclusions
└── README.md

Privacy

All header parsing and analysis happens entirely in the browser. No headers or email data are transmitted to any server.

The only external request is the optional IP geolocation lookup (click-to-activate), which sends the IP address to ipinfo.io. No lookups are made automatically — they require explicit user interaction.

Security

• Content Security Policy (CSP) restricts scripts, styles, fonts, and connections to known origins
• script-src 'self' — zero inline JavaScript, all event handling via addEventListener and delegation
• style-src 'self' — all CSS in external files, no inline <style> blocks or 'unsafe-inline'
• base-uri 'self' — prevents <base> tag injection that could redirect relative URLs
• form-action 'self' — restricts form submission targets
• frame-ancestors 'self' — prevents clickjacking via iframe embedding
• Read-only Docker container with no-new-privileges and tmpfs-only writable mounts
• All user input is HTML-escaped (including single quotes) before DOM insertion
• Alert type values are whitelist-validated before use in CSS class names
• IP addresses are validated against strict IPv4/IPv6 format regex before use in any DOM or fetch context
• Timestamp re-rendering uses textContent instead of innerHTML to prevent injection
• Server version disclosure disabled via server_tokens off
• Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• Drag-and-drop file size capped at 10 MB per file, 50 files max for bulk mode
• Share URLs use URL fragments (never sent to the server) with modern TextEncoder/TextDecoder encoding

License

MIT

---

_{A free tool by the makers of Netra — enterprise DNS change management with approval workflows, drift detection, and audit trails.}