Every hop is a witness. Every timestamp, testimony.

Advanced Email Forensics for macOS.

Parse raw RFC-5322 headers, trace transit routing paths hop by hop, and generate PDF analysis certificates — on your Mac.

Download on the
Mac App Store Explore Interactive Demo

SPF: PASS · as recorded

Negative transit latency flagged

header fields decoded per parse

auth results read instantly

MBOX archives, memory-mapped

accounts, trackers or analytics

Localized in 15 languages — your evidence reads the same in every jurisdiction.

Built for teams doing serious work

Litigation Firms Incident Response Digital Forensics Labs Law Enforcement eDiscovery Vendors

// Interactive Demo

Watch a header confess.

Load a sample forensic header and watch a replay of what HeaderLume 27.0 reports for it, hop by hop.

HeaderLume — Forensic Analysis Session

evidence/message-0447.eml

SPF

—

SPF: PASS — the sample's first Authentication-Results header records spf=pass for mail.veridian-legal.example. HeaderLume reports that record; it does not look up the domain's SPF policy.

DKIM

—

DKIM: PASS — the sample's first Authentication-Results header records dkim=pass for selector s2048. HeaderLume reports that record; it does not re-check the signature.

DMARC

—

DMARC: UNKNOWN — the sample's first Authentication-Results header says "dmarc=warn", which is not a DMARC result HeaderLume recognises, so it shows DMARC as Unknown. HeaderLume does not look up the domain's DMARC policy or check alignment.

ARC

—

ARC: PASS — the sample's first Authentication-Results header records arc=pass (i=1). HeaderLume reports that record; it does not validate ARC seals.

awaiting header evidence…

idle — no evidence loaded

// Capabilities

A full forensics lab. The core analysis needs no network.

Purpose-built for examiners, litigators, and incident responders who can't afford to leak evidence to the cloud.

On-Device MIME Parser

Raw RFC-5322 header parsing executed fully on-device. The message itself never leaves the examiner's machine.

Transit Route Mapping

Pins relay hops on an Apple Maps view where ipwho.is returns a location for a hop's address (with Zero Telemetry off; not every hop gets a pin): the lookup's location, not a measured path. Flags hops whose timestamps run backwards.

Authentication Traffic Lights

The SPF, DKIM, DMARC and ARC results recorded in the message's Authentication-Results headers, shown at a glance as pass, fail or unknown — transcribed, not re-checked.

E-Discovery Load Files

Automatic generation of a Concordance .DAT load file and an Opticon .OPT image load file (one row per document, pointing at its multi-page PDF certificate with its page count), packaged in one ZIP with the original messages.

Memory-Efficient MBOX Analysis

Analyze giant mailbox archives (10GB+) in the background: the archive is memory-mapped and split message by message, so a multi-gigabyte file does not have to fit in RAM.

Zero Telemetry

One switch that blocks every optional outside lookup the app can make.

// In the Field

Built for the examiner's bench.

Native macOS, dark by default, engineered for long analysis sessions. Click through the workflow.

HeaderLume.app — Routing Chronology

// Why Not Do It By Hand?

Manual header reading doesn't scale. Or hold up.

Anyone can squint at a Received chain. Producing defensible, repeatable findings is a different job.

Task	Reading headers manually	Generic web checkers	HeaderLume
Parse a full Received chain	Minutes, error-prone	Partial	Instant, every hop
Relay delay anomaly detection	Manual math per hop	No	Automatic Δ-analysis
SPF / DKIM / DMARC / ARC results	Read field by field	Basic	Traffic-light instant
Evidence confidentiality	Local	Uploads to third party	On-device, sandboxed
10GB+ MBOX archives	Impractical	Upload limits	Memory-mapped, in the background
Reporting output	DIY formatting	Screenshots	PDF certificates + .DAT/.OPT

// Built for the Courtroom

Findings your opposing counsel can't wave away.

Every HeaderLume analysis certificate carries its generation time (UTC); a single-message certificate also prints the examiner details you enter in Settings and, with the original message attached, its MD5, SHA-1 and SHA-256, and an e-discovery production records each document's MD5 and SHA-256 in its .DAT load file — the metadata foundation for authenticating electronic records.

Because the analysis runs on your Mac, the message itself never leaves it and your chain of custody stays intact. HeaderLume ships with Zero Telemetry off, so on each single-message analysis it sends hop addresses to ipwho.is and the sender's domain to rdap.org, which redirects HeaderLume to that domain's registry, so your Mac sends the domain there too. When a lookup returns an answer, the certificate names its service; other hop addresses looked up for the map are not listed on it. With your key, each attachment's SHA-256 also goes to VirusTotal. Turn Zero Telemetry on and HeaderLume makes none of these lookups.

Concordance .DAT and .OPT exports drop straight into Relativity and other review platforms your litigation-support team already runs.

FRE 902(13)–(14)

Self-authenticating electronic records

Rules 902(13) and 902(14) let a record generated by an electronic process, or a hashed copy, be authenticated by a written certification instead of live foundation testimony — provided the certifying person is qualified and notice is given. HeaderLume produces the record and the hashes; the certification is yours to give.

Reproducible methodology

Repeatable, documented process

Deterministic parsing of published standards (RFC 5322 message format, RFC 5321 trace fields, and the RFC 8601 Authentication-Results field) means another examiner can reproduce your findings step-for-step.

// In Practice

Where HeaderLume goes to work.

The same parser, three very different benches.

Litigation & eDiscovery

Examine disputed emails, flag spoofed chains, and hand PDF analysis certificates to counsel — a single-message certificate prints the examiner details you enter in Settings and, with the original attached, its SHA-256. Load files use the Concordance .DAT / Opticon .OPT formats that review platforms such as Relativity load.

PDF certificates · .DAT / .OPT

Incident Response

Triage phishing and BEC campaigns in seconds: follow the Received chain back to the earliest hop it records, read the SPF/DKIM/DMARC results transcribed from the message's Authentication-Results headers, and spot hop timestamps that run backwards — on privileged material, with every outside lookup HeaderLume makes named and switchable off.

SPF · DKIM · DMARC · ARC

Forensic Labs & Law Enforcement

Process entire custodian mailboxes — 10GB+ MBOX archives are memory-mapped and analyzed in the background — inside a workflow whose chain of custody never leaves your bench.

10GB+ MBOX · offline bulk

// Licensing

Evidence-grade tooling, at every scale.

Free to download. A licence unlocks analysis.

Basic

For trying the app before you buy

Free download. No account required. Analysis needs a licence.

Look around the main window — the analysis screens need a licence
Read the built-in user guide
Set your privacy and lookup preferences

Download Free

Asked by every examiner. Answered.

How do I read email headers on a Mac?

In Apple Mail, open the message and choose View → Message → All Headers, then paste the raw text into HeaderLume (or drop in the .eml file). It parses every Received hop, resolves the originating IP, and renders the transit route as a visual graph — no manual decoding.

Can HeaderLume trace the sender's IP address of an email?

Yes. It walks the Received chain in the raw RFC-5322 header, extracts each relay IP and, with Zero Telemetry off, pins each hop that ipwho.is can locate on a map (the lookup's location, not a measured path; not every hop gets a pin) — flagging hops whose timestamps run backwards, which suggests clock drift or forged headers. Note that the true origin can be masked by the first provider in the chain; HeaderLume shows you exactly how far the evidence goes.

Is email header analysis admissible in court?

Header evidence is routinely admitted when properly authenticated. HeaderLume's PDF certificates embed examiner metadata and SHA-256 evidence hashes designed to support authentication under FRE 902(13)–(14) for self-authenticating electronic records. (Consult your counsel for jurisdiction-specific requirements.)

Does HeaderLume upload my emails anywhere?

No. Parsing, reading the recorded SPF/DKIM/DMARC/ARC results and every export run on your Mac inside the macOS App Sandbox — no tracking scripts, no analytics, and nothing from your messages is logged. Three lookups can enrich a report (hop geolocation, domain age, attachment reputation): the first two are on by default, the third needs your own VirusTotal key. The Zero Telemetry switch turns off all three, so HeaderLume itself makes no outside requests; macOS may still contact the App Store for your licence and, when a relay hop is one of six built-in public-resolver addresses, fetch Apple Maps imagery to draw the map.

What's the difference between SPF, DKIM, and DMARC?

SPF checks that the sending server's IP is authorized by the domain. DKIM cryptographically proves the message wasn't altered in transit. DMARC ties both to the visible From address and tells receivers what to do on failure. A receiving mail server performs those checks and writes the outcome into Authentication-Results headers; HeaderLume reads the first such header in the message — or, when the headers follow the layout measured on mail received by Apple's servers, that block of headers read together — plus the ARC result for forwarded mail, and shows all four as instant traffic lights. It does not re-run the checks, and it cannot prove which server wrote them.

What formats does HeaderLume import and export?

Import: raw pasted headers, .eml files, and MBOX archives (memory-mapped, 10GB+ supported). Export: PDF analysis certificates, PNG header graphs, and Concordance .DAT / Opticon .OPT load files.