Analyze email headers API

Analyze caller-supplied email headers for routing hops and suspicious inconsistencies (From/Return-Path/Reply-To, auth results, dates). Indicators only—not confirmed malice.

The Analyze email headers operation is part of the Email & Communication Security API on BRAINIAC.software. Analyze caller-supplied email headers for routing hops and suspicious inconsistencies (From/Return-Path/Reply-To, auth results, dates). Indicators only—not confirmed malice. It is exposed as POST /api/v1/email-security/header-forensics and priced at $0.04 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied raw email, EML, headers, attachments, URLs, and conversation copies Public DNS TXT when publicDns is requested Public HTTP(S) redirect follows when followPublicUrls is requested Limitations: Messages are never sent and mailboxes are never logged into. Email and attachment bytes are never uploaded to external malware or sandbox scanners. Observed facts are separated from inferred threats. Indicators are not labeled confirmed malicious without sufficient evidence. Optional public DNS and URL follows are limited to public hosts with strict SSRF protections. Missing authentication or DNS evidence is reported as missing, not invented. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Detect email spoofing indicators, Detect phishing signals, Detect BEC patterns, Check domain impersonation. Open the group documentation for the full request schema, field notes, and response examples before integrating.

POST$0.04 USDC
/api/v1/email-security/header-forensics

Example request

curl -i -X POST "https://www.brainiac.software/api/v1/email-security/header-forensics" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "emails": [
    {
      "id": "M1",
      "headers": "From: Alice <alice@example.com>\nReturn-Path: <bounce@mailer.example.net>\nReply-To: help@totally-different.example\nReceived: from mail.example.net by mx.example.com; Tue, 4 Nov 2026 20:00:00 +0000\nAuthentication-Results: mx.example.com; spf=fail; dkim=fail; dmarc=fail\nMessage-ID: <m1@example.com>\nSubject: Invoice\nDate: Tue, 4 Nov 2026 20:00:00 +0000\n",
      "source": "Caller-supplied headers"
    }
  ]
}
JSON

An unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.

FAQ

  • Do I need an API key? No. Pay the listed USDC amount with x402.
  • What network? Base (eip155:8453), USDC.
  • Is this an official determination? No. Results are for human review against the cited sources.

Related APIs

Email & Communication Security APIFull docsHow it works