Local parsing

Investigate any email, end to end.

Paste headers or drop an .eml / .msg file to find out who really sent it, where its links and attachments lead, and how it got past your filters. Then use the Microsoft 365 response scripts, user messages and ticket notes to close it out. Domain health and DNS tools are built in.

Drop a .eml or .msg file here or click to browse — the file never leaves your device

Domain to check — yours, a customer's or a supplier's Customer tenant for Microsoft 365 fix scripts (optional)

Checks MX, SPF (with the 10-lookup limit), DKIM on common selectors, DMARC and report authorisation, MTA-STS, TLS-RPT, BIMI, DNSSEC and registration — using public DNS only. Nothing is changed.

Commands: dns mx spf dmarc dkim blacklist ip ptr a aaaa cname ns soa txt caa srv mta-sts tlsrpt bimi whois health — type one followed by :, or just a domain or IP. Suggestions include domains and IPs from the email you're analysing. Click any host, IP or include in the results to look it up next.

Drop DMARC aggregate (RUA) reports here Select as many as you like — .xml, .xml.gz, .gz or .zip, as receivers send them. Read in your browser; nothing is uploaded.

Reports are the XML files receivers (Google, Microsoft, Yahoo…) send to the rua= address in your DMARC record. Add more at any time — duplicates are ignored.

Reputation lookups — sends extracted IPs & domains to free third-party APIs

Overview Findings Authentication Links & files Delivery Delivery path Reputation Response Messages Headers

PostVigil · messages are parsed entirely in your browser · reputation data from ipwho.is, Shodan InternetDB, public DNSBLs, SURBL & RDAP

Print / save as PDF

Produces a clean report for tickets. Choose "Save as PDF" in the print dialog for a file.

Redact recipient addresses Redact every address at your domains Include all headers Include the current response script

Compare with a known-good message

Load a genuine email from the same sender (older, from the same supplier or colleague). PostVigil compares the sending infrastructure to spot spoofing or a compromised account. Parsed locally.

Choose .eml / .msg

Follow this link in a sandbox (urlscan.io)

urlscan.io visits the link from its own infrastructure, follows every redirect and takes a screenshot. Nothing is opened on this machine.

URL to scan — edit it to remove anything that identifies your user

Looking for existing scans…

Visibility Private — only your urlscan account can see it Unlisted — hidden from public search, but visible to urlscan's security vendor customers Public — anyone can find the URL and screenshot. Don't use for links containing names, emails or tokens.

Drop to analyse