{"uid":"cap_KSGfNjqaw_bEjnl2byHpY","slug":"email-header-analyzer-9df73acf","name":"Email Header Analyzer","description":"Analyze raw email headers: sender, recipient, subject, server hops (Received) with delays, SPF/DKIM/DMARC results, Return-Path and Reply-To mismatches and spoofing signals, with a verdict. Investigate phishing or delivery issues. Nothing is stored.","url":"https://api.vextorium.com/v1/email-headers?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"required":["headers"],"properties":{"headers":{"type":"string"}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":["object","null"],"properties":{"for":{},"date":{},"from":{"type":["string","null"]},"hops":{"type":["array","null"],"items":{}},"subject":{"type":["string","null"]},"verdict":{"type":["string","null"]},"reply_to":{"type":["string","null"]},"warnings":{"type":["array","null"],"items":{"type":["null","string"]}},"message_id":{},"return_path":{},"total_delay_s":{"type":["number","null"]},"authentication":{"type":["object","null"],"properties":{"spf":{"type":["string","null"]},"dkim":{"type":["string","null"]},"dmarc":{"type":["string","null"]}}}}}}}}},"responseSchema":{"type":"json","example":{"for":null,"date":null,"from":"Bank <security@bank-example.com>","hops":[],"subject":"Verify your account","verdict":"suspicious","reply_to":"support@other-domain.ru","warnings":["DKIM: fail","DMARC: fail"],"message_id":null,"return_path":null,"total_delay_s":0,"authentication":{"spf":"pass","dkim":"fail","dmarc":"fail"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_2RvcNZH9jXutrFidOGVi7","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes raw email headers for spoofing signals, authentication results (SPF/DKIM/DMARC), server hop delays, and Return-Path/Reply-To mismatches, returning a verdict","exampleAgentPrompt":"Can you analyze these raw email headers and tell me if this email is spoofed or a phishing attempt? I want to see the SPF, DKIM, and DMARC results, any Reply-To or Return-Path mismatches, and an overall verdict.","exampleUseCases":[{"title":"Phishing email investigation","prompt":"I got a suspicious email claiming to be from my bank — here are the raw headers. Can you check if it's spoofed, look at the SPF/DKIM/DMARC results, flag any Reply-To or Return-Path mismatches, and give me a verdict on whether it's a phishing attempt?"},{"title":"Email deliverability troubleshooting","prompt":"Our transactional emails aren't landing in inboxes. Can you analyze these email headers and show me each server hop with delays, the authentication results, and anything that might explain why we're getting flagged?"},{"title":"Security team triage alert","prompt":"We flagged an inbound email for review — here are its full headers. Please check the Received chain for unusual hops, verify the SPF, DKIM, and DMARC status, highlight any spoofing signals, and give us an overall suspicion verdict."}],"resultDescription":"A JSON object containing the parsed from address, subject, date, recipient, message ID, Return-Path, Reply-To, a list of server hops with delays, total delivery delay in seconds, SPF/DKIM/DMARC authentication results, an array of warnings (e.g. 'DKIM: fail'), and a final verdict string (e.g. 'suspicious', 'clean').","failureModes":["Missing or malformed email headers input returns an error","Truncated headers may cause incomplete hop analysis or null fields","Non-standard header formats from legacy mail servers may not parse correctly","Empty or whitespace-only headers body will fail validation"],"whenToPreferThis":"Choose this endpoint when you need a structured, automated analysis of raw email headers specifically for security or deliverability purposes — especially when you need SPF/DKIM/DMARC results, spoofing signals, Reply-To/Return-Path mismatch detection, and an overall verdict in a single call. Prefer this over manual header parsing tools when building phishing triage agents or deliverability debugging workflows. Note that nothing is stored, making it suitable for privacy-sensitive email data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T18:55:27.822Z","isFirstParty":false,"canonicalSlug":"email-header-analyzer-9df73acf"}