ReaperCloud

Forensic Email Analyzer

Upload a suspicious message or paste its headers. Nothing is stored, no link in the message is ever visited, and the message is never rendered.

The whole message, saved from your mail client. This is the better option: it includes the body, the links and the attachments, and the bytes are exactly as sent, so DKIM signatures can be checked.
Headers alone are enough for the delivery chain and authentication. Paste the body too and the links get analysed as well.
How to save a message as .eml
  • Outlook (desktop)Drag the message from the list onto your desktop, or File → Save As → choose "Outlook Message Format" and rename to .eml.
  • Outlook on the webOpen the message → ⋯ → Download. Forwarding it to yourself first will lose the original headers.
  • GmailOpen the message → ⋮ → Download message.
  • Apple MailDrag the message to the desktop, or File → Save As → Raw Message Source.
  • ThunderbirdRight-click the message → Save As → choose .eml.

Forward the message as an attachment rather than inline if you have to move it first. Forwarding inline rewrites the headers, and the headers are most of the evidence.