<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Email Header Forensics

## grep — Header Extraction
```bash
grep "^Received:" headers.txt | tac
grep -E "^(Authentication-Results|Received-SPF|DKIM-Signature):" headers.txt
grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' headers.txt | sort -u
grep "^Message-ID:" headers.txt
```

## python3 — Header Parsing
```python
import email
msg = email.message_from_file(open("message.eml"))
for key, value in msg.items():
    print(f"{key}: {value}")
```

## MxToolbox — Online Analysis
```
# Paste headers at https://mxtoolbox.com/EmailHeaders.aspx
```
