headAnalyzer — Release notes

by Ironline Security · home

v1.2.0

DNS blocklist (RBL) checks

New Blocklists section on the Summary tab. One-click web-checker links (MXToolbox, Spamhaus, Barracuda) for the source IP, plus an opt-in live DNS-over-HTTPS check against Spamhaus, SpamCop, Barracuda, PSBL, UCEPROTECT and DroneBL.
A source IP found on a blocklist is added to the findings and factors into the verdict (one list → medium, two or more → high).
securityEach list is self-tested with the standard 127.0.0.2 point, so a blocklist that refuses public-resolver queries is reported unavailable — never a false "not listed."
The live check is opt-in and never automatic; it sends only the source IP to a public resolver, and only when you click. See Privacy.

Detection hardening

securityARC tempering no longer trusts the raw, unvalidated ARC-Seal: cv= tag — only the receiver-recorded arc=pass verdict downgrades SPF/DKIM/DMARC failures. A forged seal can no longer make a real spoof read as clean. Tempering notes now carry a forgeability caveat, and a tempered verdict is capped below "high confidence."
securityHomograph detection upgraded: internationalized (punycode) domains are decoded and whole-script / mixed-script lookalikes (e.g. Cyrillic аррӏе → apple.com) are now flagged high, while legitimate IDNs (e.g. münchen) stay low.
Exchange header parsing: connecting IPs written in bare parentheses ((20.22.61.90), IPv6) are now extracted; TLS is detected from the full with clause (Microsoft SMTP Server (version=TLS1_2 …)); the full protocol phrase is kept.
Paste mode now stops at the header/body boundary, so a pasted full message can't inject fake Received:/From: lines.
Test suite expanded to 139 cases, including output-escaping (XSS) regression coverage.

Initial release

SPF / DKIM / DMARC / Microsoft CompAuth / ARC authentication analysis with a rolled-up verdict and ranked findings.
Sender-identity checks: display-name impersonation, Reply-To / Return-Path / Message-ID mismatches.
Received routing chain with per-hop delays, connecting IPs, per-hop TLS, clock-skew and slow-delivery detection.
Confidence indicator, header-row highlighting, and external reputation/DNS lookup links.
Internal-forward tempering (Exchange AuthAs: Internal) to reduce false positives on gateway-forwarded mail.