An email says your bank account is locked and you have to confirm your details today. It looks right: the logo, the tone, the name of a real bank. You do not want to click anything, and you do not want to paste the message into a website that promises to check it for you. Here is how to pull the message out as a file and read what it really says, on your own Mac, with nothing uploaded anywhere.
Step 1: get the message out as a file
Do not forward the message to yourself or to IT. Forwarding creates a new message with new headers, and the original headers are exactly the part you need.
Instead, save the original as a file. Most mail clients can save a single message as an .eml file, which is the standard RFC 822 format. Outlook saves single messages as .msg. If you use Apple Mail, each message already exists on disk as an .emlx file under ~/Library/Mail/, and you can drag it straight out. mailin opens all three formats with its own parsers, with no conversion step.
Step 2: open it in mailin
Drag the file into mailin or use the file picker. The format is detected automatically. The free tier handles up to 500 emails and includes headers and attachments, with no account and no payment details, so you can open one message and read its headers without signing up for anything.
Nothing leaves your device. mailin contains no email server code at all, collects no analytics, and works fully offline. The only network activity in normal use is App Store purchase verification. The privacy post covers the full picture.
Step 3: read the headers, not the logo
The visible From line is the easiest thing in an email to fake. What is harder to fake is everything a real mail server added on the way in.
Start with the Received chain. Each server that handled the message added a line at the top, so reading from the bottom up shows the route it took. mailin's routing analysis lays this out. A message from a large bank should arrive through infrastructure that plausibly belongs to that bank or its mail provider, not through a residential connection or a server in a country the bank has no reason to use.
Then look at the Authentication-Results header. This is where the server that received the message recorded whether SPF, DKIM and DMARC passed. mailin reads these results as the receiving server reported them. It does not run its own DNS checks, because the receiver's verdict at delivery time is the one that matters, and DNS records may have changed since. Our SPF, DKIM and DMARC guide explains each mechanism in more depth.
What a failed check does and does not prove
If DKIM or DMARC shows a fail for a message claiming to be from your bank, that is a strong reason for suspicion, because banks generally have their authentication in order. But it is not proof. Legitimate mail fails these checks when it has been forwarded, when it passed through a mailing list, or when the sender's DNS is misconfigured.
The opposite case is the one people forget. A message can pass every check and still be fraudulent. Criminals register domains that look like the bank's and set up SPF, DKIM and DMARC correctly for those domains, because they own them. So a pass tells you the message genuinely came from the domain in the header. It does not tell you that the domain is your bank. Read the domain character by character.
Step 4: links, attachments and IOCs
The next thing to check is where the links actually go, as opposed to what the link text says. mailin extracts IOC artifacts, meaning IP addresses, URLs and file hashes, automatically, so you can see every destination without hovering over anything or opening the message in a browser.
The MIME tree view shows every part of the message, including parts the mail client hid, and every attachment gets a hash. Do not open the attachment. If you need to check it, compare the hash against whatever threat intelligence you have access to, and leave the file closed.
For IT admins: reaching a verdict
If you are the person a whole company forwards these to, the Phishing Incident workflow gives the process some structure. Its steps are Intake, Analyze (headers and authentication, URLs, attachment hashes, IOC extraction), Verdict, Contain and Close.
The Verdict step has three outcomes: Confirmed, Safe or Needs-info. That third option matters. Plenty of messages cannot be settled from the headers alone, and recording that honestly is better than guessing. Contain exports an IOC blocklist from what was found, and the whole job is saved as a numbered document you can reopen when the same lure shows up again. When many copies arrive at once, Phishing Campaign (Bulk) handles the set together.
These features are designed to support common records-integrity and eDiscovery workflows. Admissibility of digital evidence is jurisdiction-specific and depends on factors beyond any single software tool — consult qualified legal counsel for evidentiary use.
FAQ
Do I need to pay to check a single message?
No. The free tier covers up to 500 emails, includes headers and attachments, and asks for no account or payment information. The tier comparison lists what each paid tier adds.
Does mailin upload the message to check it?
No. Parsing and header analysis run entirely on your device. mailin contains no code for talking to mail servers, and the optional Cloud AI mode is off by default and only ever sends excerpts you explicitly choose to your own AI provider.
The email passed all three checks. Is it safe?
Not necessarily. A pass means the message came from the domain it claims, but that domain may be a lookalike, or a real account may have been compromised. Check the exact domain spelling and the link destinations before trusting it.