A .eml file is a raw email saved to disk, including the full header block your mail app keeps hidden. Those headers trace the message backward from your inbox to the machine it was sent from - every relay server with its IP and timestamp - and record whether the sender's identity actually checks out. It is one of the most revealing files an ordinary person can hand to someone else.
Scan a Email fileThe core of an email header is the Received chain. Headers are stamped on in reverse, so the last Received line is the first hop, closest to the sender - File X-Ray surfaces that origin hop's hostname and IP, counts how many servers the message passed through, and hunts for the sending IP across every header that records it: X-Originating-IP, Received-SPF, X-Forwarded-For, Microsoft Exchange's own client-IP header, X-Real-IP and X-Client-IP, matching both IPv4 and IPv6. A public address there can be geolocated to a city and a network provider.
Two timestamps in a .eml file place the sender without needing an IP at all. The origin hop's timestamp is stamped in the sender's own mail-server time zone, so its UTC offset drops them into a geographic band. And Outlook and Exchange bury a FILETIME inside the Thread-Index header that records when the whole conversation started - a hidden timestamp that predates the individual message. The DKIM signature's t= value adds when the message was cryptographically signed.
The headers also tell you whether to trust the sender. The DKIM signing domain (d=) and its selector name the infrastructure that actually signed the mail, which is often a marketing or mail platform rather than the visible brand. SPF, DKIM and DMARC results are read from Authentication-Results, and a Sender Mismatch is flagged when the visible From domain does not match the envelope Return-Path domain - a classic sign of spoofed or forwarded mail.
Finally, a saved message leaks who was really involved and which organisation sent it. A surviving Bcc line means the file is the sender's own copy and names people nobody else could see; Delivered-To, X-Original-To and Envelope-To name the real mailbox behind an alias or list. A Microsoft 365 Tenant ID ties every message from a company together and can be resolved back to that company, and the X-Mailer, Exchange internal headers and up to twenty-five other custom X- headers identify the tools in the sending pipeline.
This is a selection. The full field manual documents the fields read from each format.
The full path the message took: every mail server it passed through, the sender's originating IP, the time zone of the sending server, the DKIM signing domain, SPF/DKIM/DMARC results, and often the sending organisation's Microsoft 365 tenant ID. Your mail app shows almost none of this by default.
Often, yes. File X-Ray reads the originating IP from X-Originating-IP, Received-SPF, X-Forwarded-For, Exchange and other headers, and a public address can be geolocated to a network and city. Even without an IP, the origin server's time-zone offset narrows the sender to a geographic band.
Look for a Sender Mismatch, where the visible From domain does not match the envelope Return-Path domain, and for SPF, DKIM or DMARC results that are anything other than pass. File X-Ray flags all of these, and shows the real DKIM signing domain so you can see who actually sent the message.
The delivery headers travel with a saved .eml file, which is exactly why it is so revealing. One tell: if a Bcc line is still present, the file is the sender's own copy, because that header is not supposed to survive delivery to a normal recipient.
Drag the .eml into File X-Ray. It parses the headers entirely in your browser - nothing is uploaded to a server - and lays out the sender IP, relay chain, authentication results and hidden recipients as plain findings.
File X-Ray reads Email files entirely in your browser - the file never leaves your device. This format is inspected, not modified. Scan a file now.