search⌘KtranslateENexpand_moreupload_fileConvert

An email is a text file: headers, a blank line, and nested MIME parts

Save any message as .eml and you get RFC 5322 headers (every server that handled it adds a Received line on top), then a body split by MIME boundaries into text, HTML, inline images and attachments, each in quoted-printable or base64. A DKIM signature covers chosen headers and a hash of the body. This page rebuilds the tree, traces the route, decodes every part, and checks the DKIM signature itself with Web Crypto.

folder_openOpen .emlSigned newsletterEdited after signingPhishing-styledownloadDownload

newsletter.eml: signed here with a new RSA-2048 key: alternative + related HTML, inline logo by Content-ID, RFC 2231 attachment name, 3 hops

MIME tree7 nodes · 5.5 KB

multipart/mixed2 partsbody + attachments

multipart/alternative2 partssame content, pick one

text/plain; UTF-8273 Bquoted-printable

multipart/related2 partsHTML + the images it references

text/html; UTF-8496 Bquoted-printable

image/png1.2 KBbase64 · inline · “logo.png” · Content-ID logo@fileformer.example

application/pdf125 Bbase64 · attachment · “Programm Oktober: Ölmühle.pdf”

The route, read bottom to top

3 Received headers · 6 s from first to last hop

hop 1 · ESMTPmail.fileformer.examplefrom app-7.internal (app-7.internal [10.0.3.7])2026-10-03 08:14:03Z

arrow_forward3 s

hop 2 · ESMTPSmx-in.example.comfrom mail.fileformer.example (mail.fileformer.example [203.0.113.10])2026-10-03 08:14:06Z

arrow_forward3 s

hop 3 · LMTPimap.example.comfrom mx-in.example.com (mx-in.example.com [192.0.2.25])2026-10-03 08:14:09Z

arrow_forwardinbox

From"FileFormer News" <news@fileformer.example>

Return-Path<bounce@fileformer.example>envelope sender: where bounces go, what SPF checks

ToAda Lovelace <ada@example.com>

SubjectÖlmühle café: October issue=?UTF-8?Q?=C3=96lm=C3=BChle_caf=C3=A9_=E2=80=94_October_issue?=

DateSat, 03 Oct 2026 09:14:02 +01002026-10-03T08:14:02.000Z

Message-ID<20261003081402.4f2a9c@mail.fileformer.example>

List-Unsubscribe<https://fileformer.example/unsubscribe?u=ada>, <mailto:unsub@fileformer.example>one-click (RFC 8058), required for bulk senders since 2024

SPF passDKIM passDMARC pass

check_circleEnvelope sender aligned with From.fileformer.example.

check_circleDKIM domain aligned with From.d=fileformer.example: the signature can satisfy DMARC.

info1 remote image(s).https://track.fileformer.example/o.gif?u=ada&m=2026-10: a 1×1 image is a tracking pixel that reports when you open the mail.

check_circleInline image cid:logo@fileformer.example found.Resolved to its MIME part via Content-ID.

check_circleDKIM body hash matches.The body is byte-for-byte what was signed (after canonicalisation).

DKIM verification · done here, step by step

Signature valid: d=fileformer.example vouches for this exact message

Selector s=oct2026, domain d=fileformer.example, algorithm rsa-sha256, canonicalisation relaxed/relaxed. The body hash is recomputed from the bytes in this file; the signature is verified with Web Crypto against the public key published at oct2026._domainkey.fileformer.example.

dnsFetch key from DNS (oct2026._domainkey.fileformer.example)public key: sample key generated in this tab (not published in DNS)

more_horiz

1 · Canonicalise the body (relaxed)Collapse runs of spaces, strip trailing whitespace, drop empty lines at the end, end with CRLF. 3,658 bytes.

This is a multi-part message in MIME format.

------=_FF_mixed_8f1c
Content-Type: multipart/alternative; boundary="----=_FF_alt_2b7e"

------=_FF_alt_2b7e
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hello Ada,

Our October issue is out: the =C3=96lm=C3=BChle caf=C3=A9 meetup moved to 1=
8:30, and the new archive tools can now open .tar.gz files right in your br=
owser without uploading anything.

Read it online: https://fileformer.example/news/2026-10

=E2=80=94 The FileFormer team

------=_FF_alt_2b7e
Content-Type: multipart/related…

check

2 · SHA-256 of the body = bh= ✓computed NL8k3pp52d9/nSB1TJ5TAbN3eul7NNXxGDY5jUbCMuA=

more_horiz

3 · Build the signed header blockHeaders listed in h= (from:to:subject:date:message-id:mime-version:content-type), each the last occurrence first, canonicalised, then the DKIM-Signature header itself with b= emptied.

from:"FileFormer News" <news@fileformer.example>
to:Ada Lovelace <ada@example.com>
subject:=?UTF-8?Q?=C3=96lm=C3=BChle_caf=C3=A9_=E2=80=94_October_issue?=
date:Sat, 03 Oct 2026 09:14:02 +0100
message-id:<20261003081402.4f2a9c@mail.fileformer.example>
mime-version:1.0
content-type:multipart/mixed; boundary="----=_FF_mixed_8f1c"
dkim-signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=fileformer.example; s=oct2026; h=from:to:subject:date:message-id:mime-version:content-type; bh=NL8k3pp52d9/nSB1TJ5TAbN3eul7NNXxGDY5jUbCMuA=; b=

check

4 · RSA-SHA256 verify with the public keyWeb Crypto verify() returned true: the headers above are exactly what fileformer.example signed.

part 1.1.1 · text/plain297 B encoded → 273 B decoded

Content-Typetext/plain; charset=UTF-8

Content-Transfer-Encodingquoted-printable

Hello Ada,

Our October issue is out: the Ölmühle café meetup moved to 18:30, and the new archive tools can now open .tar.gz files right in your browser without uploading anything.

Read it online: https://fileformer.example/news/2026-10

- The FileFormer team

download decoded part (273 B)

links in the HTML · text vs where it really goes

Read it onlinehttps://fileformer.example/news/2026-10?utm_source=emailCarries tracking parameters.

Unsubscribehttps://fileformer.example/unsubscribe?u=adaCarries tracking parameters.

attachments · declared type vs actual bytes

attach_fileProgramm Oktober: Ölmühle.pdfapplication/pdf · 125 B · actual: PDF · name via RFC 2231

encoding lab

Getting “Ölmühle” through a 7-bit pipe

SMTP was designed for 7-bit ASCII and 998-byte lines. Bodies use quoted-printable (mostly readable, =XX for anything else) or base64 (always 4 characters per 3 bytes). Headers use RFC 2047 encoded-words, and attachment names use RFC 2231. Type anything to see each form; paste an encoded string into the second box to decode it.

decode (encoded-word, quoted-printable or base64)Account locked: verify today

quoted-printable body48 B for 34 B

Programm Oktober =E2=80=93 =C3=96lm=C3=BChle.pdf

base64 body48 B (+33%)

UHJvZ3JhbW0gT2t0b2JlciDigJMgw5ZsbcO8aGxlLnBkZg==

RFC 2047 encoded-word, Bfor Subject, From names

=?UTF-8?B?UHJvZ3JhbW0gT2t0b2JlciDigJMgw5ZsbcO8aGxlLnBkZg==?=

RFC 2047 encoded-word, Qreadable when mostly ASCII

=?UTF-8?Q?Programm_Oktober_=E2=80=93_=C3=96lm=C3=BChle=2Epdf?=

RFC 2231 parameterfor attachment filenames

filename*=UTF-8''Programm%20Oktober%20%E2%80%93%20%C3%96lm%C3%BChle.pdf

Reference

headerwho writes it, what it proves

Receivedeach server prepends one; only the hops written by your own provider are trustworthy

Return-Pathadded at delivery from MAIL FROM; SPF checks this domain

Fromwhat the user sees; DMARC protects this domain

Reply-Towhere replies go; any value is allowed

Message-IDunique id; threading uses it with In-Reply-To and References

DKIM-Signaturedomain-signed hash of chosen headers and the body

Authentication-Resultsthe receiving server’s verdicts for SPF, DKIM, DMARC, ARC

ARC-Seal / ARC-*forwarders vouch for earlier results (RFC 8617)

List-Unsubscribemailto: or https: unsubscribe; with -Post, one click

MIME-Version1.0, always; Content-Type and boundaries follow

Content-Transfer-Encoding7bit, 8bit, binary, quoted-printable or base64

Content-IDid that HTML references with cid:

MIMEmessage/rfc822 (.eml); mbox files concatenate messages after “From ” lines

Line limits998 octets per line, 78 recommended; CRLF line endings

Charsetsheaders ASCII (RFC 2047 for the rest, or RFC 6532 UTF-8 with SMTPUTF8); bodies declare charset

Outlook .msgnot MIME: an OLE compound file; this page reads .eml only

DKIM keysTXT at selector._domainkey.domain; RSA 1024-2048 or Ed25519 (RFC 8463)

DMARCTXT at _dmarc.domain: p=none, quarantine or reject, with rua= reports

Sizebase64 attachments grow by 4/3; many providers cap messages at 25 MB

PrivacyReceived lines can include the sender’s internal hostnames and IPs; remote images reveal when you read

1982RFC 822The text message format: headers, blank line, body.

1992MIMERFC 1341, then 2045-2049 (1996): multipart, charsets, base64.

2001RFC 2822Message format revised; RFC 5322 in 2008.

2006SPFRFC 4408: which IPs may send for a domain.

2011DKIMRFC 6376 (after RFC 4871 in 2007).

2015DMARCRFC 7489 ties SPF and DKIM to the visible From.

2019ARCRFC 8617: authentication results that survive forwarding.

2024bulk rulesGmail and Yahoo require SPF, DKIM, DMARC and one-click unsubscribe for bulk senders.

Tools for taking an email apart

DNS LookupLook up the DKIM selector, SPF and DMARC records this page relies on.oct2026._domainkey…arrow_forwardv=DKIM1; k=rsa; p=…Base64Decode base64 attachment bodies and check strict vs lenient decoding.JVBERi0xLjQK…arrow_forward%PDF-1.4 URL EncoderSee how RFC 2231 percent-encoding relates to URL encoding.%C3%96lm%C3%BChlearrow_forwardÖlmühle Hash GeneratorHash an attachment to compare it with a published checksum or a threat feed.statement.pdf.exearrow_forwardsha256 …Timestamp ConverterParse RFC 5322 dates from Received lines in any zone.Sat, 03 Oct 2026 09:14:02 +0100arrow_forward08:14:02Z Text CleanerReveal invisible and look-alike characters in sender names.“Ⅼogin”arrow_forwardU+216C detected

sourcesRFC 5322 message format RFC 2045 MIME RFC 2047 encoded-words RFC 2231 parameters RFC 6376 DKIM RFC 7489 DMARC