Opening an .eml File Without Telling the Sender

Two kinds of image, and only one of them talks

A remote image is an address in the message pointing at a file on someone else's server; your reader fetches it when it draws the page, and that fetch carries your IP address, the time, and often a code identifying which copy of the newsletter was sent to you. Shrink such an image to one transparent pixel and it becomes invisible while still reporting — which is exactly what a tracking pixel is. Blocking remote loads costs a little layout and removes the report entirely.

An inline image is a different animal: it is an attachment inside the file, and the body refers to it as cid: followed by an identifier. Signatures, logos and screenshots pasted into a message usually arrive this way. Nothing has to be fetched to show them, so they are displayed straight away from the bytes already in front of you, and no server anywhere learns that you looked.

What the headers can tell you

The visible From line is chosen by whoever sent the message and proves nothing on its own. The interesting ones sit above it: Return-Path, which is where bounces actually go, and the chain of Received lines, each added by a server as the message passed through, read from the bottom up. A message claiming to come from your bank whose Received chain starts at a residential connection is worth a second look, and you can settle that question from the file without asking anyone.

Headers fold, which is why they can look mangled in a plain text editor: a long Received line continues on the following lines, each starting with a space or a tab, and reading them as separate headers is how a three-line hop turns into three broken fields. They are rejoined before display here, so what you see is the header as it was written.

Frequently asked questions

Can I open a .eml without any mail program installed?

Yes — that is what this is for. The file is plain text, so any text editor will show you the raw form, and the viewer renders the readable one: decoded headers, decoded body, attachments listed. It is also the usual way to read a message that was forwarded to you as a file, which no mail client will show you inline.

Is the message uploaded to be rendered?

No. It is parsed and rendered in your browser. That is worth more here than for most file types: a saved message is somebody's correspondence, often with an address book's worth of recipients in the headers and a document attached, and there is no good reason for it to travel to a server just to be read.

The message shows as a wall of =3D and =C3=A9. What is that?

Quoted-printable, the encoding that lets a message with accents travel over a channel that only guarantees plain ASCII. Each non-ASCII byte is written as an equals sign and two hexadecimal digits, and a line too long to send is broken with a trailing equals sign that means the next line continues it. Decoded, =C3=A9 is é and the broken lines rejoin. The viewer does that for you; a text editor does not, which is why the raw file looks like that.