Email Phishing Analysis & Header Inspector
Strip Outlook .msg and .eml files. Compare declared senders against actual mail servers, detect spoofing with Red/Green indicators, and safely sandbox suspicious links.
Inspect Suspicious Email & Stripped Headers
Upload an Outlook message (.msg), standard MIME email (.eml), or paste raw transport headers for instant threat analysis.
Drag & drop your .msg or .eml file here
Or click to browse from your device (Max size: 10MB)
Server MTA Forensics & Alignment
Trace the chronological server hops taken by the message. Compare header From: against envelope Return-Path:, reverse DNS records, and SPF/DKIM/DMARC authentication.
Safe Link Detonation & Defanging
All embedded links are automatically neutralized (hxxps[://]). Detect deceptive anchor text mismatches, unmask URL shortener chains, and inspect landing pages in total isolation.
Linguistic & Attachment Sentinel
Detect high-pressure psychological urgency ("24 hours to act"), Cyrillic homoglyph character obfuscation, and dangerous attachment formats (.exe, .iso, .docm) before they harm your team.
Frequently Asked Questions About Email Phishing
What is the difference between a .msg and a .eml file?
A .msg file is Microsoft Outlook's proprietary binary format (Compound File Binary) used to save individual messages, attachments, and MAPI metadata. A .eml file is an open standard MIME format (RFC 822 / RFC 5322) used by Gmail, Apple Mail, Thunderbird, and standard internet mail transfer agents. Our analyzer parses both formats safely in-memory.
Is it safe to upload a suspicious email to Cankal Software?
Yes. Our tool operates under a strict Zero-Storage Policy. The file is parsed purely in ephemeral server RAM without writing email bodies, attachments, or sender identities to disk or databases. Attached files are never executed.
What do SPF, DKIM, and DMARC mean in simple words?
SPF (Sender Policy Framework) is like a company's authorized list of mail servers. DKIM (DomainKeys Identified Mail) is a digital wax seal proving the message wasn't tampered with in transit. DMARC tells receiving servers what to do (e.g. reject or quarantine) if an email fails SPF or DKIM.
Can just opening an email infect my computer?
Modern webmail clients and mail software generally disable automatic execution of malicious code in the preview pane. However, clicking deceptive hyperlinks, opening macro-enabled attachments (.docm, .xlsm), or downloading executables (.exe, .iso, .vbs) can infect your device. Our tool lets you inspect everything safely without opening it in your mail client.
What should I do if the analyzer flags an email as Red (Critical Danger)?
Do not click any links, do not open attachments, and do not reply. Report the email to your corporate IT security administrator immediately. If you suspect an active breach or executive account takeover, contact Cankal Software for emergency incident response.
Need Expert Phishing Remediation or Enterprise Mailbox Forensics?
Our certified cybersecurity team assists UK and international organizations with emergency incident response, Business Email Compromise (BEC) containment, and full SPF/DKIM/DMARC hardening.