drop eml or msg · paste headers · received chain · spoofing indicators · IP extraction · export csv · runs locally
.msg uses transport headers only (0x007D) — drop .eml for best results
drop .eml / .msg or paste raw headers