Email header analyzer API

Parse raw email headers into the Received hop chain with per-hop delays, SPF/DKIM/DMARC auth results, originating IP, message-id, and spam/anomaly signals — the hop + auth parsing an LLM does unreliably, done deterministically. Answers 'parse these email headers', 'did this email pass SPF/DKIM/DMARC', 'what is the originating IP of this message', 'how long did this email take to deliver'.

Price$0.01per request

MethodPOST

Route/v1/security/email-headers

StatusLive

MIME typeapplication/json

Rate limit60/minute

CacheNo cache

securityemailheadersspfdkimdmarcforensicsphishing

API URLhttps://x402.hexl.dev/v1/security/email-headers

Integration docs

Example request

{
  "headers": "Received: from relay.example.net (relay.example.net [203.0.113.10]) by mx.dest.com with ESMTP; Mon, 02 Jun 2025 10:00:30 +0000\nReceived: from mail.origin.org (mail.origin.org [198.51.100.5]) by relay.example.net with SMTP; Mon, 02 Jun 2025 10:00:00 +0000\nAuthentication-Results: mx.dest.com; spf=pass; dkim=pass; dmarc=pass\nFrom: Alice <alice@origin.org>\nReturn-Path: <alice@origin.org>\nSubject: Hello\nMessage-ID: <abc@origin.org>"
}

Example response

{
  "from": "Alice <alice@origin.org>",
  "to": null,
  "subject": "Hello",
  "date": null,
  "messageId": "<abc@origin.org>",
  "returnPath": "<alice@origin.org>",
  "originatingIp": "198.51.100.5",
  "auth": {
    "spf": "pass",
    "dkim": "pass",
    "dmarc": "pass"
  },
  "hopCount": 2,
  "totalDeliverySeconds": 30,
  "hops": [
    {
      "index": 0,
      "from": "mail.origin.org",
      "by": "relay.example.net",
      "with": "SMTP",
      "ip": "198.51.100.5",
      "timestamp": "2025-06-02T10:00:00.000Z",
      "delaySeconds": null
    },
    {
      "index": 1,
      "from": "relay.example.net",
      "by": "mx.dest.com",
      "with": "ESMTP",
      "ip": "203.0.113.10",
      "timestamp": "2025-06-02T10:00:30.000Z",
      "delaySeconds": 30
    }
  ],
  "anomalySignals": [],
  "suspicious": false
}

Input schema

{
  "type": "object",
  "required": [
    "headers"
  ],
  "properties": {
    "headers": {
      "type": "string",
      "minLength": 1,
      "examples": [
        "Received: from mail.origin.org (mail.origin.org [198.51.100.5]) by relay.example.net with SMTP; Mon, 02 Jun 2025 10:00:00 +0000\nAuthentication-Results: mx.dest.com; spf=pass; dkim=pass; dmarc=pass\nFrom: Alice <alice@origin.org>\nSubject: Hello"
      ]
    }
  }
}

Output schema

{
  "type": "object",
  "additionalProperties": true
}