Suspicious Email Checker

Open a saved .eml message to inspect warning signals. No email is uploaded or sent anywhere.

Local: yes. Your input stays on your device and is not sent to an external service for this tool.

Maximum 5 MB. Export the message as .eml in your mail application first.

PostalMime parses the message in this browser. We do not fetch links or authenticate mail servers. Never rely on this tool alone to approve a payment.

What does the email checker inspect?

Differences between the From and Reply-To domains, visible link hosts, IP-based and unencrypted links, punycode and potentially active attachments. These are warning signs, not a probability or proof of fraud.

What cannot it prove?

It does not validate SPF, DKIM or DMARC, access mailboxes, open links, execute attachments or scan for malware. A clean result does not mean a message is safe. Verify invoice changes via a trusted phone number.

Private by design

The PostalMime parser is bundled by GratisTools and runs in this browser. No raw message bytes leave the device.

Are my files uploaded?

No. Email review runs with JavaScript and WebAssembly running in your browser tab. Your files are read from your device and the results are created on your device; nothing is sent to gratistools.be or anyone else, which is also why there are no queues, daily limits or watermarks. See the privacy page.

Frequently asked questions

Is this tool free?

Yes. The core tool is free to use in your browser.