# Email Header Analyzer — REST API endpoint `email-header-analyzer`

Return a structured analysis of raw email headers: sender, recipient, subject, date, message id, the Received hop chain with per-hop delays, SPF/DKIM/DMARC results, every public IP seen, and suspicious-routing flags.

- Category: security
- MCP server: https://mcp.findutils.com/ (Streamable HTTP, no API keys, 120 req/min per IP)
- REST endpoint: POST https://api.findutils.com/api/tools/email-header-analyzer/execute (no API keys, 60 req/min per IP)
- Reference page: https://findutils.com/api/email-header-analyzer/
- Same tool on the other surface: https://findutils.com/mcp/email-header-analyzer/

## Call the endpoint (verified example)

```bash
curl -X POST https://api.findutils.com/api/tools/email-header-analyzer/execute \
  -H "Content-Type: application/json" \
  -d '{
    "headers": "Received: from a.example.com (a.example.com [203.0.113.9]) by mx.example.org; Tue, 18 Aug 2026 10:00:02 +0000\nAuthentication-Results: mx.example.org; spf=pass; dkim=pass; dmarc=pass\nFrom: alice@example.com\nTo: bob@example.org\nSubject: Hello\nDate: Tue, 18 Aug 2026 10:00:00 +0000\nMessage-ID: <m1@example.com>"
  }'

# Parameter schema
curl https://api.findutils.com/api/tools/email-header-analyzer
```

## Input schema

| Argument | Type | Required | Description |
|---|---|---|---|
| `headers` | string | yes | The raw email headers (the "Show original" / "View source" block), including every Received: line. |

Example arguments (verified):

```json
{
  "headers": "Received: from a.example.com (a.example.com [203.0.113.9]) by mx.example.org; Tue, 18 Aug 2026 10:00:02 +0000\nAuthentication-Results: mx.example.org; spf=pass; dkim=pass; dmarc=pass\nFrom: alice@example.com\nTo: bob@example.org\nSubject: Hello\nDate: Tue, 18 Aug 2026 10:00:00 +0000\nMessage-ID: <m1@example.com>"
}
```

OpenAPI 3.1 spec: https://findutils.com/api/openapi.json · Interactive docs: https://findutils.com/api/docs/

## Also an MCP tool

```bash
claude mcp add findutils --transport http https://mcp.findutils.com/
```

Then ask the client to call `findutils:email_header_analyzer`. Full MCP reference: https://findutils.com/mcp/email-header-analyzer/

---
Full catalog: GET https://api.findutils.com/api/tools · https://findutils.com/api/ · https://findutils.com/llms.txt