What does the forensic view do?
The Forensic tab answers a simple question: does this message really come from who it claims? It analyses the headers and the content and lays the findings out clearly. That helps you spot phishing and forged senders much faster.
Everything stays local
The forensic analysis runs entirely in your browser. Nothing is sent to a server; the hashes are calculated locally too.
SPF, DKIM and DMARC
Three protocols help verify the sender. Mbox Viewer reads the verdicts from the Authentication-Results header and shows them as pass, fail or neutral.
- SPF (Sender Policy Framework)checks whether the sending IP is allowed to mail on behalf of that domain. A fail with an unusual domain is a strong signal of spoofing.
- DKIM (DomainKeys Identified Mail)checks the digital signature of the sending server. Pass means the content was not changed in transit; stronger evidence than SPF.
- DMARC (Domain-based Message Authentication)combines SPF and DKIM and requires alignment with the From domain. Pass with alignment is the strongest signal that the message is genuine.
The suspicion score and the nine signals
Mbox Viewer calculates a suspicion score from 0 to 100 based on nine signals. The higher the score and the more high-severity signals, the more suspicious the message.
| Signal | Severity | What it means |
|---|---|---|
| Display-name spoof | high | The display name imitates a known sender but the address does not match |
| Reply-To mismatch | medium | The reply address differs from the sender |
| Punycode in domain | high | The domain uses IDN characters to imitate a real domain |
| SPF, DKIM or DMARC fails | high | At least one authentication check failed |
| Date mismatch | medium | The send date does not match the route |
| Missing Message-ID | medium | A normal, legitimate message almost always has a Message-ID |
| Suspicious top-level domain | low | The domain ends in a tld often linked to abuse |
| Tracking pixel | medium | It contains an invisible pixel that reports the open |
| URL mismatch | high | The visible link text differs from the real destination |
A high score is a strong indication, not proof. Always combine the score with common sense: does the sender, the tone and the requested action add up? When in doubt, do not click and do not reply.
Hashes and the route
For evidence, Mbox Viewer calculates a SHA-256 and an MD5 hash of the message and of the attachments. With a hash you can later prove that a file was not changed. That builds a verifiable chain of custody.
The Received chain is shown as a visual route: each step the message travelled, with the TLS status (was the connection encrypted?) and the timing per hop. Unusual jumps or unencrypted steps stand out immediately.
Assess a suspicious message
- Open the message and go to the Forensic tab.
- Look at the SPF, DKIM and DMARC verdicts. Several fails are a red flag.
- Read the suspicion score and the signals listed below it.
- Check the route for illogical jumps or unencrypted hops.
- Still unsure? Filter with
is:suspiciousto find similar messages in your archive.
Does a high score mean the message is definitely phishing?
No. The score is a tool that adds up suspicious traits. Always assess the content and the context yourself as well.
Where do the SPF, DKIM and DMARC verdicts come from?
From the Authentication-Results header the receiving mail server added to the message. Mbox Viewer reads and explains those verdicts.
What do I use the hashes for?
A SHA-256 or MD5 hash is a fingerprint of the file. It proves that a message or attachment has not changed since it was captured.
What is a tracking pixel?
An invisible image that tells the sender you opened the message. Mbox Viewer blocks external images by default and flags such a pixel as a signal.
Next, learn how to export a forensic case file with AES-256.