Authentication, decoded
SPF, DKIM, DMARC and ARC results in plain words — did this mail really come from where it claims?
Autonomous email autopsy · OffSeq Cybersecurity
Forward a suspicious email.
Forward a suspicious email.
Get a forensic verdict.
Forward a suspicious email to Inspect. In about a minute, get a forensic report back: safe or not, and exactly why.
Forward it to
inspect@offseq.email
No sign-up. The report comes straight back to your inbox.
- ~60stypical report time
- 6analysis layers / email
- EU onlydata never leaves the EU
Prefer to upload?
Drop a .eml file
Exported a message as a file? Scan it right here — same forensic analysis, same EU residency, auto-deleted.
Drag & drop a .eml here, or
Max 25 MB · 3 scans per hour · analysed in the EU, then deleted
How it works
Four steps. No software to install.
-
1
You forward it
Send the questionable email to inspect@offseq.email from the inbox that received it.
-
2
We take it apart
Headers, sender identity, every link and every attachment — pulled apart and checked.
-
3
We open the dangerous parts safely
Links open in a throwaway browser and files in a sealed sandbox — isolated, then destroyed after the check.
-
4
You get a verdict
A plain-language report lands in your inbox with a 0–100 risk score and the evidence behind it.
What you get back
A report that shows its work.
Every claim is backed by evidence you can read, with suspicious links defanged and never clickable. English or Latvian.
Impersonation & deception
Display-name spoofing, look-alike domains, and reply-to / return-path mismatches that try to fool you.
Links, unwrapped
Shorteners and redirect chains followed to the real destination, with a browser screenshot of the page — captured in isolation, up to 3 links per email.
Domain & infrastructure
Domain age, MX / DNS records and TLS posture of the sender and any destination — the boring details attackers get wrong.
Attachments, detonated
Static analysis in a sealed sandbox: real file type vs. claimed, macros, embedded URLs, malware and YARA matches.
A verdict you can act on
A deterministic 0–100 score, the top reasons, and a clear recommended action — not a vague “be careful”.
Security & EU data residency
The dangerous email never reaches you.
Stored only in the EU
The email, screenshots and report are stored only in EU-jurisdiction Cloudflare R2 and D1 (region EEUR). The AI analyst reads the message text on Cloudflare Workers AI; nothing is kept there.
Detonation in isolation
Links open in a throwaway Cloudflare Browser Run and files in a one-shot Sandbox, both destroyed after each check. Nothing dangerous ever runs on your device.
The verdict is explainable
A team of AI analysts (large language models) investigates the sender, the message, the links and the files, follows up where needed, and decides. Hard evidence such as confirmed malware or a forged sender is a protected floor, and every finding is shown with its evidence.
Everything auto-deletes
We keep the minimum, for the shortest time. There are no accounts.
| What | Kept for |
|---|---|
| Original email & attachments | 72 hours |
| Browser screenshots | 7 days |
| The forensic report | 30 days |
| Anonymised threat indicators (attacker links, domains, malware hashes) and malicious attachment samples | indefinitely |
Part of the OffSeq Cybersecurity ecosystem
Inspect is one piece. Here is the rest.
Inspect judges one email at a time. The wider OffSeq Cybersecurity ecosystem watches your whole attack surface, continuously.
Web security
Continuously monitor your domain’s SPF, DKIM, DMARC and web exposure — the same sender authentication Inspect checks on every message, watched around the clock.
Open Guard
Dark web
Know the moment your credentials surface in a leak or on the dark web — the accounts phishing emails like these are trying to reach.
Open Breach
Threat intel
Vulnerability intelligence ranked by what actually hits your stack, so you patch what matters first.
Open Threat Radar
Live telemetry · last 90 days
What Inspect is seeing.
Live figures from real inspections, updated continuously.
127emails inspected
67%flagged risky
~56savg time to verdict
54links opened in isolation
98attachments sandboxed
Verdict distribution
- No strong threat indicators 29%
- Low suspicion 4%
- Suspicious 26%
- High risk 36%
- Likely malicious 5%
Top attack vectors seen
- From-claimed domain's DMARC policy is monitoring-only (p=none)70
- Message-ID domain differs from sender42
- Message is not DKIM-signed41
- No DMARC result for this message35
- From address is not authenticated for its own domain (DMARC failed)32
- DMARC evaluation failed32
Fair use
Talk to us → support@offseq.com
3 inspections per hour, per address
Enough for anyone checking the occasional suspicious message. Need higher volume, integrations, or team access? Get in touch — OffSeq’s security services go far beyond a single inbox.