Investigate an email address — MX and syntactic validation, Gravatar lookup, corporate email-format inference, breach exposure, and full mail-header analysis covering the Received chain, Message-ID and SPF, DKIM and DMARC results. Use for email OSINT, verifying whether an address exists, finding accounts registered to it, guessing a company's email format, or tracing where a suspicious message actually came from. Applies to business email compromise and invoice-fraud investigation, phishing tria
Detected risks:
what-an-email-reveals is an OSINT tradecraft skill for investigating an email address by working its structure and footprint rather than trying to prove the mailbox exists. It covers syntactic and MX/domain validation, Gravatar avatar and profile lookup by MD5 hash, corporate email-format inference from the local part, breach-exposure checks, and full mail-header analysis of the Received chain, Message-ID, and SPF/DKIM/DMARC results.
The skill teaches which validation methods prove what (and why interactive SMTP RCPT-TO probing is exposing, often lied to, and useless against catch-all domains), Gmail dot/plus normalization and what a `+tag` reveals, and passive ways to find where an address is registered — quoted searches, breach membership, handle-hunting, and code-commit metadata — while flagging account-enumeration via reset/signup forms as interactive, often against terms of service, and potentially notifying the subject. For headers, it explains reading the Received chain bottom-up, why a DKIM pass is the strongest signal, and how Message-ID and X-Mailer fingerprint the sending platform. Bundled references detail header fields and corporate address formats. It opens by requiring a written authorized scope and explicitly says never to send mail to the subject as a research technique.
It targets investigators handling business email compromise and invoice fraud, phishing triage, vendor-payment verification, and pre-engagement research. Most of the workflow is passive and defensively oriented (tracing where a suspicious message came from), which is relatively benign, but it is still dual-use OSINT on individuals — inferring identities, formats, and account footprints — and it discusses interactive enumeration techniques, so it rates below a purely benign skill.
It does syntactic and MX/domain validation passively, but it deliberately avoids interactive SMTP RCPT-TO probing, which it describes as exposing, frequently blocked or lied to, and worthless against catch-all domains. It treats existence as a bonus, not the goal.
A likely name and corporate address format, a Gravatar profile, breach exposure, linked accounts and usernames via search and handle-hunting, and — with the message in hand — the originating infrastructure from headers.
Gmail ignores dots and everything after a plus in the local part, so several different-looking addresses can be one mailbox; a plus tag also often names the service the address was given to.
Read the Received chain bottom-up (earliest hop at the bottom), trust nothing below the first server you trust, and weight a DKIM pass most heavily since it is a cryptographic signature that survives forwarding.
Never send mail to the subject as a research technique, and treat account enumeration via password-reset or signup forms as interactive, often against terms of service, and potentially notifying — to be authorized explicitly or skipped.
Quick Setup:
.claude/skills/Repository
useosint/osint-skills