EML and MSG File Viewer
Open Outlook .msg and .eml email files in your browser. Read the message safely, check its SPF, DKIM and DMARC results, trace every server it passed through and save its attachments. Your file never leaves your device. Drop an .eml or .msg file here Outlook .msg, .eml from Gmail, Apple Mail or Thunderbird, or a .txt file with the raw message source.
Opened in your browser. Nothing is uploaded.
The message is shown in a locked sandbox with scripts off and remote images blocked, so tracking pixels and hidden code don't run when you open it. How the EML and MSG File Viewer Works
The viewer reads the email file with JavaScript on your own device. There is no upload step, so you can open messages that contain private or sensitive data.
1
Add the email file
Drop an .eml or Outlook .msg file on the box, or choose it from your computer. A .txt file with the raw message source works too.
2
The file is decoded locally
We decode the MIME parts or Outlook's binary format, character sets and encoded headers. Then we read the Authentication-Results and Received headers.
3
Review the message
See the sender details, SPF, DKIM and DMARC results, domain alignment, the delivery path with per-hop delays, the message body and every attachment.
What Are EML and MSG Files?
Both formats store a complete email, including headers, body and attachments. They differ in how the data is packed.
EML: plain text MIME
An EML file is the raw message as defined in RFC 5322, with MIME parts for HTML, text and attachments. Thunderbird and Apple Mail save it, and Gmail exports it with Download message.
MSG: Outlook's binary format
Outlook saves messages as MSG files. They use Microsoft's compound file (OLE) container with MAPI properties for each field. Without Outlook, most computers can't open them.
Why security teams use them
Users report phishing by forwarding the original as an attachment. Opening that file in a mail client can load tracking images or show a fake link as safe. A safe viewer lets you inspect it first.
Check a phishing email → What You Can Check in an Email File
These are the warning signs the viewer flags, what each one means, and what to do next.
SPF, DKIM or DMARC failed
The receiving server couldn't verify the sender
A DMARC fail means neither SPF nor DKIM passed for the domain in the From address. The message may be spoofed, or the real sender has a broken setup.
Treat the message as untrusted. If it's your own domain, check your DMARC record and sending sources.
Misaligned domains
SPF or DKIM passed for a different domain
SPF checks the envelope sender and DKIM checks the
d= domain. If neither matches the From domain, the pass proves nothing about the visible sender.Compare the three domains in the alignment table. Senders should sign with DKIM using their own domain.
Reply-To mismatch
Replies go to a different domain
Fraud and invoice scams often use a real or lookalike From address with a Reply-To the attacker controls, so the conversation moves away from the real sender.
Don't reply. Contact the sender through a known address or phone number.
Display name spoofing
The name shows a different email address
A display name like
"[email protected]" <[email protected]> hides the real address in many mail apps. Only the address in the angle brackets is the sender.Check the real sender address with our fake email address checker.
Risky attachment
HTML, ISO, ZIP, EXE or macro files
Attackers use
.html files for fake login pages, .iso and .zip to get past filters, and .docm or .xlsm files for macros. Double extensions like invoice.pdf.exe are a strong sign of malware.Don't open it on a work device. Send it to your security team or scan it in an isolated system.
Odd delivery path
Long or unusual Received chain
Many hops, long delays or servers in unexpected networks can mean the message was relayed through compromised or bulk-sending infrastructure.
Open the Headers tab and paste the headers into the email header analyzer for IP and reputation details.
How the Viewer Keeps You Safe
Suspicious emails can contain tracking pixels, scripts and links that look harmless. The viewer is built so that opening a message doesn't trigger any of them.
Nothing is uploaded
The file is read by your browser and stays on your device. We don't store or see the messages you open.
Sandboxed, no scripts
The HTML body is shown in a fully sandboxed frame. Scripts, forms and plugins are blocked, and links are disabled. The table under the message shows where each one really points.
Remote images blocked
Images hosted on outside servers don't load unless you turn them on, so tracking pixels never tell the sender you opened the message. Embedded images still show.
Attachments are never opened
Attachments are listed with their real file type and size. They only reach your device if you choose to download them.
Frequently Asked Questions
How do I open an EML or MSG file without Outlook?
Drop the .eml or .msg file on the viewer above. It reads the file in your browser and shows the sender, recipients, body, headers and attachments. You don't need Outlook or any software installed.
Is it safe to open a suspicious email here?
Yes. The message body is shown in a sandboxed frame with scripts, forms and links disabled, and remote images are blocked by default. Attachments are never opened. Only download one if you know it's safe.
Are my email files uploaded to PowerDMARC?
No. The file is read and decoded by JavaScript in your browser. It isn't sent to our servers or any other service, and nothing is stored after you close the page.
Why are some images missing from the message?
Images hosted on remote servers are blocked so tracking pixels can't report that you opened the email. Turn on Load remote images above the message to show them. Images embedded in the file always display.
How do I save an email as an EML or MSG file?
In Outlook, drag the message to your desktop or use File, Save As to get a .msg file. In Gmail, open the message, click the three dots and choose Download message for an .eml file. In Thunderbird use File, Save As, and in Apple Mail use File, Save As with Raw Message Source.
Why does the viewer show no authentication results?
SPF, DKIM and DMARC results are added by the receiving mail server. Messages saved from Sent Items or Drafts never went through one, and some MSG files don't keep the original headers. Save the message from the recipient's inbox to see the results.
More Free Email Security Tools
Email Header Analyzer
Trace hops, IPs and authentication in raw headers.
Analyze headers →Phishing Email Checker
Check an email for common phishing signs.
Check email →Phishing Link Checker
Scan a URL before you click it.
Check a link →DMARC Checker
Validate a domain's DMARC record and policy.
Check DMARC →SPF Record Checker
See which servers may send for a domain.
Check SPF →DKIM Record Lookup
Look up a DKIM key by domain and selector.
Check DKIM →Fake Email Address Checker
Check whether a sender address is real.
Verify address →Lookalike Domain Checker
Find domains impersonating your brand.
Find lookalikes →Stop spoofed email before it reaches your users
PowerDMARC monitors SPF, DKIM and DMARC for all your domains, shows who sends email as you, and helps you reach a reject policy so attackers can't use your domain.