Question 1

Which authentication checks are performed?

Accepted Answer

The tool reads the SPF, DKIM and DMARC results written by the receiving server in the Authentication-Results header and flags them as pass or fail. It does not re-verify DKIM signatures itself. A failure or missing result raises the suspicion score.

Question 2

How is the suspicion score calculated?

Accepted Answer

It adds up several signals: SPF, DKIM and DMARC failures or absence, From domain different from Return-Path, Reply-To pointing to another domain, display name containing a foreign address, urgency wording in the subject… Each indicator is listed with its explanation.

Question 3

How do I use the extracted IOCs?

Accepted Answer

The Observables tab groups URLs, domains, IPs, emails and hashes with their context (From, Reply-To, origin IP, link, attachment). Each value can be copied or opened in VirusTotal, URLScan, AbuseIPDB, Shodan, crt.sh or MalwareBazaar. Defanged mode (hxxps[://]example[.]com) prevents accidental clicks; the full list exports as CSV and the Markdown report pastes straight into a ticket.

Question 4

How can I see every link in an email?

Accepted Answer

The Links tab lists every URL found in the HTML (links, images, forms), the text and the headers. For each one: the displayed text, the real destination, any destination hidden in a redirect and risk markers (deceptive text, punycode, raw IP, shortener, tracking pixel). No link is opened: in the preview they are disabled and their destination shows on hover.

Question 5

Is my .eml file sent to your servers?

Accepted Answer

No. The file is read and analyzed in your browser; it is never sent to our servers. Only the pivot links you choose to open contact a third-party service.

Question 6

Can the analysis be automated via an API?

Accepted Answer

Yes. The ForenShield API exposes the same engine: send the .eml file to POST /v1/eml/analyze with a personal API key (created from the portal) and get the verdict, links, observables and routing as JSON. The file is analyzed in memory and not stored. Documentation: forenshield.com/en/developers/api.

Email Analyzer (.eml)

Drop a suspicious email, get an analyst-grade report.

Drop a suspicious email, get an analyst-grade report.

What is analyzed