Email analysis

Parse email headers or one .eml text file locally in the browser, then organize authentication header facts, Received chain shape, MIME structure, link shape, attachment metadata, and a share-safe summary. Nothing is uploaded or verified over the network.

Local email workbench

HeadersRecognize folded lines, malformed lines, Message-ID shape, and key trace fields.

Authentication factsParse SPF / DKIM / DMARC / ARC statements already present in the message headers.

MIME summaryList bounded part types, boundaries, and attachment metadata without rendering message content.

Share-safe summaryOmit raw body text, full addresses, complete URLs, and attachment filenames by default.

Trust boundary

No uploadEmail content stays in this browser and is not submitted to the sosec backend.

No network lookupNo DNS, HTTP, or third-party lookup is performed.

No active renderingHTML and attachments are summarized as text metadata only; links are not opened.

Complete outputReports are generated only from a structured result allowlist.

SPF / DKIM / DMARC / ARC pass, fail, and none values are header statements only, marked not_verified_locally.
Received chains expose field presence, date parse state, and internal presence counts only.
Default reports omit raw header/body text, full email local-parts, raw Message-ID values, complete URLs, query values, fragments, long DKIM values, and attachment filenames.

Common next steps

URL analysis: inspect one link separately.
IOC extraction: extract observables from alert context.
Hash analysis: normalize or compare hashes you already have.

Input scope: WaitingHeader/body scope appears after analysis.

Received hops: 0Waiting for trace fields.

Auth facts: 0Waiting for authentication header statements.

Redactions: 0The share-safe summary shows counts.

Authentication header facts

Source	Method	Result	Domain label	Boundary
Authentication header statements have not been parsed yet.

Received chain shape

Hop	Fields present	Date state	Internal presence	Notes
Received chain has not been parsed yet.

Identity observations

Identity fields have not been analyzed yet.

Link summary

Link shape has not been extracted yet.

Attachment metadata

Attachment metadata has not been parsed yet.

MIME structure

MIME structure has not been parsed yet.

Redaction counts

Category	Count	Policy
No share-safe summary has been generated yet.

Structured export

Complete export

Share-safe summary