EML viewer and e-mail header analyzer, on your own device

Open a saved e-mail (.eml) or paste a message's raw source or just its headers. You get the sender, recipients and date in your own time zone, the message with every remote image blocked, the attachments to download, each server it passed through with the delay at each hop, and the SPF, DKIM and DMARC results the receiving server wrote down.

The message is read on your device. It is never uploaded, and nothing in it is loaded from the internet.

What it shows

The headers, decoded. From, To, Cc, Reply-To, Subject and Message-ID, with encoded names such as =?UTF-8?B?…?= turned back into readable text. The Date is shown as the sender wrote it, with the sender's UTC offset, and converted to your own time zone. A Reply-To or Return-Path on a different domain from the From address is pointed out.
The message. The plain-text version, or the HTML version inside a locked-down frame: scripts are removed and cannot run, and every image, stylesheet or font that would load from a web address is blocked and counted. Pictures carried inside the message itself (cid: images) still show. Links are listed with the address each one really goes to, and none of them can be clicked by accident.
Attachments with their name, type and size, each downloadable from this tab. Names written in any language, including the RFC 2231 form Outlook and Gmail use for accented file names, are decoded.
The delivery path. Every Received header, oldest first: which server it came from (with its IP address when recorded), which server took it, the protocol (SMTP, ESMTPS with TLS, LMTP…), and the time between one hop and the next. A long delay shows where a message sat in a queue or a spam filter.
SPF, DKIM and DMARC exactly as the receiving server recorded them in its Authentication-Results header, with the server's name.

What it cannot do

Outlook .msg files. A .msg is a Microsoft compound file, not a MIME message, so this page's parser does not read it. The Outlook .msg viewer does, with the same blocking of remote images; a .msg dropped here is handed to it.
Encrypted messages. An S/MIME or PGP-encrypted body can only be opened with the recipient's private key in their mail program. The page says the body is encrypted, shows the outer headers, which are not encrypted, and lists the encrypted part.
Checking signatures. DKIM, S/MIME and PGP signatures are not verified. A DKIM check needs the sender's public key from DNS, a network lookup this page does not make, and keys are often rotated, so an old message can fail a check today that it passed on arrival. The verdicts shown are the ones your provider recorded when the message came in.
Showing remote images. There is no button to load them, on purpose. If you need them, open the message in your mail program.
Mailbox files. A .mbox holds many messages; only one message per file or paste is read.
Very large messages. The whole file is read into this tab's memory. A 100 MB message with attachments is fine on a laptop and may be too much for an older phone.

Getting the .eml or the headers

Gmail: Open the message, then the ⋮ menu next to Reply: “Download message” saves an .eml, and “Show original” shows the raw source with a “Copy to clipboard” button you can paste here.
Outlook: Outlook on the web and the new Outlook for Windows can save a message as .eml from the message's ⋯ menu. Classic Outlook for Windows saves only .msg; open the message, then File › Properties, and copy the “Internet headers” box.
Apple Mail: File › Save As… with the format “Raw Message Source” writes an .eml. View › Message › Raw Source (⌥⌘U) shows the same text to copy.
Thunderbird: File › Save As › File saves an .eml. View › Message Source (Ctrl+U) shows the raw text.

Useful to know about e-mail headers

Why remote images are blocked: Newsletters and marketing mail usually contain a 1 × 1 pixel image whose address is unique to you. Loading it tells the sender that you opened the message, when, roughly where (from your IP address) and with which program. A mail program that shows remote images, as Apple Mail does unless you change it, loads the pixel as soon as the message is opened, a saved .eml included. Here it is never requested.
Reading Received headers: Each server adds its Received line on top, so the raw headers read bottom-up. The top few lines were added by your own provider and are reliable. Everything below them was written by servers before it, including the sender's, and can be forged, so an IP address in the bottom line proves little on its own.
SPF, DKIM and DMARC in one line each: SPF: the sending server's IP address is on the list published by the domain in the Return-Path. DKIM: a domain (the d= value) signed the headers and body, and they were not changed on the way. DMARC: SPF or DKIM passed for a domain that matches the one in the From address, which is what stops simple From spoofing.
Why the file is bigger than its attachments: Attachments inside an .eml are stored as base64 text in 76-character lines, which makes them about 37 % larger than the real file. A 10 MB PDF makes an .eml of about 13.7 MB, which is why providers' 25 MB limits hold less than 25 MB of files.