.eml ยท .eml

What Email Headers in a .eml File Reveal

A .eml file is a raw email saved to disk, including the full header block your mail app keeps hidden. Those headers trace the message backward from your inbox to the machine it was sent from - every relay server with its IP and timestamp - and record whether the sender's identity actually checks out. It is one of the most revealing files an ordinary person can hand to someone else.

Scan a Email file

What a .eml file reveals

The core of an email header is the Received chain. Headers are stamped on in reverse, so the last Received line is the first hop, closest to the sender - File X-Ray surfaces that origin hop's hostname and IP, counts how many servers the message passed through, and hunts for the sending IP across every header that records it: X-Originating-IP, Received-SPF, X-Forwarded-For, Microsoft Exchange's own client-IP header, X-Real-IP and X-Client-IP, matching both IPv4 and IPv6. A public address there can be geolocated to a city and a network provider.

Two timestamps in a .eml file place the sender without needing an IP at all. The origin hop's timestamp is stamped in the sender's own mail-server time zone, so its UTC offset drops them into a geographic band. And Outlook and Exchange bury a FILETIME inside the Thread-Index header that records when the whole conversation started - a hidden timestamp that predates the individual message. The DKIM signature's t= value adds when the message was cryptographically signed.

The headers also tell you whether to trust the sender. The DKIM signing domain (d=) and its selector name the infrastructure that actually signed the mail, which is often a marketing or mail platform rather than the visible brand. SPF, DKIM and DMARC results are read from Authentication-Results, and a Sender Mismatch is flagged when the visible From domain does not match the envelope Return-Path domain - a classic sign of spoofed or forwarded mail.

Finally, a saved message leaks who was really involved and which organisation sent it. A surviving Bcc line means the file is the sender's own copy and names people nobody else could see; Delivered-To, X-Original-To and Envelope-To name the real mailbox behind an alias or list. A Microsoft 365 Tenant ID ties every message from a company together and can be resolved back to that company, and the X-Mailer, Exchange internal headers and up to twenty-five other custom X- headers identify the tools in the sending pipeline.

Key fields

Origin Hop
The first mail server in the delivery chain, closest to the sender; its hostname and IP reveal the sender's provider or network.
Originating IP
The sending IP recorded by the mail system, pulled from any header that carries it; a public one can geolocate the sender.
Sender Time Zone
The UTC offset the first mail server stamped, which runs in the sender's time zone and places them in a region without resolving any IP.
DKIM Signing Domain
The domain that cryptographically signed the message (d=) plus its selector, naming the true sending infrastructure.
Sender Mismatch
The visible From domain does not match the envelope Return-Path domain - a common characteristic of spoofed mail.
SPF / DKIM / DMARC Result
The authentication results recorded by the receiving server; anything other than pass can indicate spoofing.
Thread Started
When the conversation began, decoded from the FILETIME Outlook/Exchange hides in the Thread-Index header - a timestamp predating this message.
Bcc
Blind recipients hidden from everyone on To and Cc; because this header should not survive delivery, its presence means the file is the sender's own copy.
Delivered-To
The mailbox that actually received the message, naming the real account behind an alias or mailing list.
Microsoft 365 Tenant ID
The stable identifier of the sender's Microsoft 365 tenant, linking every message from that organisation and resolvable back to it.
Delivery Hops
How many mail servers the message passed through on its way to the inbox.
Mail Client
The email client or software that composed the message (X-Mailer / User-Agent).

This is a selection. The full field manual documents the fields read from each format.

Questions about Email metadata

What information is hidden in an email's headers?

The full path the message took: every mail server it passed through, the sender's originating IP, the time zone of the sending server, the DKIM signing domain, SPF/DKIM/DMARC results, and often the sending organisation's Microsoft 365 tenant ID. Your mail app shows almost none of this by default.

Can a .eml file reveal the sender's IP address and location?

Often, yes. File X-Ray reads the originating IP from X-Originating-IP, Received-SPF, X-Forwarded-For, Exchange and other headers, and a public address can be geolocated to a network and city. Even without an IP, the origin server's time-zone offset narrows the sender to a geographic band.

How can I tell if an email was spoofed?

Look for a Sender Mismatch, where the visible From domain does not match the envelope Return-Path domain, and for SPF, DKIM or DMARC results that are anything other than pass. File X-Ray flags all of these, and shows the real DKIM signing domain so you can see who actually sent the message.

Do email headers survive when a message is saved or forwarded?

The delivery headers travel with a saved .eml file, which is exactly why it is so revealing. One tell: if a Bcc line is still present, the file is the sender's own copy, because that header is not supposed to survive delivery to a normal recipient.

How do I read a .eml file's headers safely?

Drag the .eml into File X-Ray. It parses the headers entirely in your browser - nothing is uploaded to a server - and lays out the sender IP, relay chain, authentication results and hidden recipients as plain findings.

File X-Ray reads Email files entirely in your browser - the file never leaves your device. This format is inspected, not modified. Scan a file now.

All supported formats