<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Email Forensics

## Python email Module (stdlib)

```python
import email
from email.policy import default

with open("message.eml", "rb") as f:
    msg = email.message_from_binary_file(f, policy=default)

msg["From"]           # Sender
msg["To"]             # Recipient
msg["Subject"]        # Subject line
msg["Date"]           # Sent date
msg["Message-ID"]     # Unique ID
msg.get_all("Received")  # SMTP relay chain (list)

# Walk MIME parts
for part in msg.walk():
    print(part.get_content_type())
    if part.get_content_disposition() == "attachment":
        data = part.get_payload(decode=True)
```

## pffexport (libpff-tools)

```bash
# Export all messages from PST
pffexport -m all mailbox.pst

# Export specific folder
pffexport -m all -f "Inbox" mailbox.pst

# Export to EML format
pffexport -m all -t eml mailbox.pst
```

## extract-msg (Python)

```python
import extract_msg

msg = extract_msg.Message("email.msg")
print(msg.sender, msg.subject, msg.date)
for att in msg.attachments:
    att.save(customPath="./extracted/")
```

## dkimpy — DKIM Verification

```python
import dkim

with open("message.eml", "rb") as f:
    message = f.read()

result = dkim.verify(message)  # Returns True/False
```

```bash
# CLI verification
dkimverify < message.eml
```

## SPF Verification

```bash
# Check SPF record for domain
dig TXT example.com | grep spf
nslookup -type=TXT example.com

# Python SPF check
pip install pyspf
python -c "
import spf
result = spf.check2(i='1.2.3.4', s='sender@example.com', h='mail.example.com')
print(result)  # ('pass', 250, 'sender is authorized')
"
```

## DMARC Verification

```bash
# Check DMARC record
dig TXT _dmarc.example.com

# Expected format:
# v=DMARC1; p=reject; rua=mailto:dmarc@example.com; pct=100
```

## Key Email Header Fields

| Header | Purpose | Spoofable |
|--------|---------|-----------|
| `From` | Display sender | Yes |
| `Reply-To` | Reply address | Yes |
| `Return-Path` | Envelope sender | Partially |
| `Received` | SMTP relay chain | First hop only |
| `Message-ID` | Unique identifier | Yes |
| `X-Originating-IP` | Sender IP (webmail) | No (server-set) |
| `Authentication-Results` | SPF/DKIM/DMARC | No (receiver-set) |
| `DKIM-Signature` | Cryptographic signature | No |

## munpack — MIME Attachment Extraction

```bash
# Extract all attachments from EML
munpack message.eml

# Extract to specific directory
mkdir extracted && cd extracted && munpack ../message.eml
```
