OTInstaller
Sign in

email-header-parser

v0.1.0Verified publisher

Parses raw email headers into senders, relay hops, IPs and SPF/DKIM/DMARC results

Community-packaged from github.com/osintverse-community/email-header-parser: the registry's community pins the upstream release; the tool is its authors' work. Maintain that project? Claim this package.

Run

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/email-header-parser","target":"Received: from mail.example.org (mail.example.org [93.184.216.34]) by mx.example.net; Mon, 6 Jan 2025 10:00:05 +0000\nFrom: Example <sender@example.org>\nAuthentication-Results: mx.example.net; spf=pass; dkim=pass; dmarc=pass","input_type":"string"}

Or just say: "Run osintverse-community/email-header-parser on Received: from mail.example.org (mail.example.org [93.184.216.34]) by mx.example.net; Mon, 6 Jan 2025 10:00:05 +0000 From: Example <sender@example.org> Authentication-Results: mx.example.net; spf=pass; dkim=pass; dmarc=pass with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/email-header-parser --headers "Received: from mail.example.org (mail.example.org [93.184.216.34]) by mx.example.net; Mon, 6 Jan 2025 10:00:05 +0000\nFrom: Example <sender@example.org>\nAuthentication-Results: mx.example.net; spf=pass; dkim=pass; dmarc=pass" --format table
ot install osintverse-community/email-header-parser

Docker image in a read-only container · no network · no key · up to 1 min. The first ot run installs the tool after asking once. The example value is the registry's own test input, so this command has run. Drop --format table for JSON.

Don't have ot? Install it in one line
curl -fsSL https://get.otinstaller.com/ot | sh
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.
irm https://get.otinstaller.com/ot.ps1 | iex
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →
  • Pinnedimage sha256:58ccadc6…9af053. The same bytes on every install; ot pulls by digest, never by tag.
  • Signedby https://github.com/osintverse-community/email-header-parser/.github/workflows/otinstaller-release.yml@refs/heads/main via token.actions.githubusercontent.com, verified by the registry on 20 Oct 2026. ot checks the same identity before every install and refuses another signer.
  • Scanned20 Oct 2026: 0 critical, 44 high, 63 medium, 62 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 89 packages.
  • Workssmoke test passed on 20 Oct 2026 (exit 0 in 7.1 s, offline sandbox); the nightly health check passed (today).
  • Backed upa copy of this image is on the registry's mirror. If the original registry refuses it, ot pulls the same digest from the mirror and checks the same signature.
  • Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

What you get back

Result envelope →
{
  "envelope": 1,
  "tool": "osintverse-community/email-header-parser@0.1.0",
  "runtime": "docker",
  "input": {
    "headers": "Received: from mail.example.org (mail.example.org [93.184.216.34]) by mx.example.net; Mon, 6 Jan 2025 10:00:05 +0000\nFrom: Example <sender@example.org>\nAuthentication-Results: mx.example.net; spf=pass; dkim=pass; dmarc=pass"
  },
  "started_at": "2026-10-21T09:00:00Z",
  "duration_ms": 4100,
  "exit_code": 0,
  "entities": [
    {
      "type": "email",
      "value": "ada@example.com",
      "confidence": "high"
    },
    {
      "type": "domain",
      "value": "example.com"
    },
    {
      "type": "ip",
      "value": "192.0.2.1"
    }
  ],
  "warnings": []
}

Every tool returns this shape, shaped here from what this tool declares it finds. --format table to read it; ot extract and ot auto to continue.

email-header-parser

Reads the headers of a suspicious email and pulls out who it claims to be from, the reply and bounce addresses, the servers it passed through with their public IPs and times, and the SPF, DKIM and DMARC verdicts. Runs offline.

ot run osintverse-community/email-header-parser --headers "$(cat headers.txt)"

Inputs

Input Required
headers yes The raw headers, as copied from "Show original"; \n escapes are accepted

Notes

Copy the headers from your mail client (Gmail: ⋮ → Show original; Outlook: File → Properties). Received hops are listed oldest first; private and reserved IPs are left out. Header values can be forged by the sender, except the hops added by servers you trust (normally the last one or two).

Next steps

Check the relay IPs with osintverse-community/ipwhois and the sender's domain with osintverse-community/checkdmarc.

Development

pip install # no dependencies
python -m unittest
ot validate

Releases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).

License

MIT

Guides using this tool

Email investigation playbook

Trace a suspicious message and find where an address is registered, without alerting its owner

About email
beginner
Verified publisher

What next

email-header-parser finds email, domain, ip. Tools that take those:

email → 10 toolsdomain → 9 toolsip → 3 toolsot auto, with a saved result

Esc

Try

↑ ↓ to move↵ to open