GetOpenInbox provides an online email header analyzer for messages received by a temporary inbox. It displays raw source using the message format defined by RFC 5322, reported SPF, DKIM, and DMARC results, and common sender, link, and attachment-name warning signals.
Create a temporary inbox to analyze an incoming message.
How to use the analyzer
- Open GetOpenInbox and copy the generated address.
- Send the test or verification message to that address.
- Open the message after it appears in the inbox.
- Review its authentication and risk sections.
- Open the raw source to inspect delivery headers and MIME structure.
The inbox session currently lasts 10 minutes. Use non-sensitive test data and analyze the message before the session expires.
What the report covers
- SPF, DKIM, and DMARC results reported in the received headers.
- Differences between visible sender and technical sender domains.
- Shortened links, IP-address links, Punycode domains, and other suspicious URL patterns.
- Potentially dangerous attachment filenames.
- Original headers and MIME source for manual investigation.
What the analyzer does not do
The tool does not accept arbitrary pasted headers, scan mailbox accounts, test SMTP ports, or guarantee that a message is safe. Authentication passes can coexist with phishing or a compromised sender. A warning may also have a legitimate explanation.
For careful interpretation, follow the step-by-step email header analysis guide and the explanation of SPF, DKIM, and DMARC results.
References
- RFC 5322: Internet Message Format — message and header-field syntax.
- RFC 8601: Authentication-Results — how receiving systems record authentication results.
- RFC 7208: SPF, RFC 6376: DKIM, and RFC 9989: DMARC — the relevant authentication standards.
- Cloudflare Email Routing — routing documentation for the underlying inbound-email platform.