Email Header Analyzer

A Windows desktop application for analyzing email headers from .msg (Outlook) and .eml files. Visualizes routing paths, checks SPF/DKIM/DMARC authentication, detects spam indicators, and flags security concerns.

Built with WPF and .NET 8. Ships as a single self-contained executable with no installer required.

---

Features

• Dual format support — Analyze .msg (Outlook) and .eml (standard MIME) files
• Drag and drop — Drop files directly onto the window for instant analysis
• Raw header input — Paste headers from any source for quick analysis
• Security analysis — SPF, DKIM, and DMARC authentication verification
• Routing visualization — Hop-by-hop path with timestamps and delay calculation
• Spam detection — Extracts scores from SpamAssassin, Barracuda, and other systems
• Security warnings — Flags authentication failures, domain mismatches, unusual patterns
• Export — HTML, JSON, CSV, and plain text output formats
• Dark/Light theme — Follows Windows system theme automatically
• Single executable — No install, no DLLs, no runtime dependencies

Screenshots

Installation

Download

Download the latest release from the Releases page.

Variant	Description	Requirements
EmailHeaderAnalyzer-self-contained.exe	Single file, runs anywhere	None
EmailHeaderAnalyzer-tight.exe	Smaller single file	.NET 8 Desktop Runtime
EmailHeaderAnalyzer-Setup.exe	Self-extracting installer	.NET 8 Desktop Runtime

Build from Source

Requires the .NET 8.0 SDK.

git clone https://github.com/mcoelho/EmailHeaderAnalyzer.git
cd EmailHeaderAnalyzer
dotnet publish -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true

The executable will be in bin\Release\net8.0-windows\win-x64\publish\.

For all build variants (normal, tight, self-contained, installer):

.\build.ps1

See Building for details.

Usage

1. File input — Click "Browse" or drag-and-drop a .msg/.eml file
2. Text input — Switch to the "Text Input" tab and paste raw email headers
3. Analyze — Results populate automatically on file drop, or click "Analyze"
4. Export — Select a format (HTML / JSON / CSV / TXT) and click "Export"

Analysis Output

Section	Details
Summary	From, To, Reply-To, Subject, Date, Message-ID
Routing	Received headers as a hop table with calculated delays
Authentication	SPF, DKIM, DMARC results (PASS / FAIL / NONE)
Spam Scores	Extracted from X-Spam-Status, X-Spam-Score, X-Barracuda-Spam-Score
Warnings	Auth failures, domain mismatches, high spam scores, unusual delays
Attachments	List of attachment filenames and sizes

Options

• Verbose — Include all headers, including custom X-headers
• JSON Output — Display results as formatted JSON

Building

Prerequisites

• .NET 8.0 SDK
• 7-Zip (only needed for the installer variant)

Build Script

.\build.ps1 [-Configuration Release] [-Clean] [-SkipInstaller]

Produces four variants under Release/:

Folder	Description
normal/	Framework-dependent multi-file build
tight/	Trimmed single-file (requires .NET Desktop Runtime)
self-contained/	Full self-contained single-file (~60 MB)
installer/	7-Zip self-extracting installer with icon

Single-File Publish

.\publish-single-exe.ps1

Enterprise Deployment

• Code signing — The executable can be signed with enterprise certificates
• AppLocker — Compatible with Windows application control policies
• No dependencies — Self-contained build has zero external requirements
• No network — Fully offline analysis, no data leaves the machine
• Group Policy — Deploy via SCCM, Intune, or file share

Tech Stack

Component	Library
UI Framework	WPF (.NET 8)
MSG Parsing	MsgReader 6.0.11
EML Parsing	MimeKit 4.16.0
JSON	Newtonsoft.Json 13.0.4

Contributing

Contributions are welcome. See CONTRIBUTING.md for guidelines.

License

MIT