osint_email_headers
Parse raw email headers from 'Show original' into a structured forensic report showing the delivery path, authentication results (SPF/DKIM/DMARC), and security indicators without querying external servers.
Instructions
Email Header Analyzer. Parse raw email headers (the "Show original" / full source block of a message) into a structured forensic report: the Received hop chain reversed into chronological delivery order, SPF/DKIM/DMARC results extracted from Authentication-Results, sender/subject/date basic info, TLS version and cipher, spam indicators, attachment hints, and an overall summary with recommendations. Use this when you already have the literal header text and want to trace how a message travelled and whether its authentication passed. It does NOT query DNS or contact any server, so it cannot fetch a domain's published policy - use network_spf_record_checker or network_dmarc_record_checker for live DNS record lookups, and osint_domain_age for registration data. Runs locally on the text you provide: read-only, non-destructive, offline, and rate-limited (10 requests/minute for anonymous callers, CAPTCHA above 30/hour). Returns nested analysis objects (basic_info, routing, authentication, security, spam_indicators,
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| headers | Yes | Raw email header text, one "Header-Name: value" per line with leading-whitespace folded continuation lines supported. Header names are matched case-insensitively. Must not be blank. Paste the full headers from "Show original"/"View source". |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| success | No | Whether the headers were parsed successfully. | |
| analysis | No | Full parsed analysis. Absent when success is false (error string returned instead). | |
| error | No | Error message; present only when success is false (blank input or parser failure). |