Supported Features
-
Dark Interface
-
Differentiate Without Color Alone
HeaderLume
EML & MBOX Forensics for Court
Only for Mac
Free · In‑App Purchases
Mac
Built for examiners, defenders and e-discovery teams: a header exhibit, Concordance DAT and Opticon OPT load files, and the message hashed inside the PDF.
Email header analysis is the easy part. Defending the exhibit is the job. HeaderLume analyzes headers on your Mac and produces a certificate you can hand to opposing counsel: a PDF that can carry the original message inside it as a real file attachment, with MD5, SHA-1 and SHA-256 of the exact attached bytes printed on the page.
The certificate states its source — a file, a message in an .mbox, or text with no source file — and never implies a file that does not exist.
For security analysts, legal examiners, e-discovery teams and corporate IT.
THE CERTIFICATE AND THE PRODUCTION
• Investigator details, anomaly log, authentication results, full routing chain
• Nothing is truncated: long Received: headers print in full, every hop
• Embedding the message is a per-export choice — headers-only otherwise
• E-discovery ZIP: documents/*.eml, *.pdf, Concordance DAT, Opticon OPT
• PNG network graph, JSON for SIEM ingestion, CSV summary
AUTHENTICATION READ FROM THE RAW BYTES
SPF, DKIM, DMARC and ARC verdicts come from the first Authentication-Results header (on mail in iCloud's layout, from that block of headers read together), read from the file's raw bytes, before any MIME decoding — so an encoded-word or a quoted string cannot change the verdict text this app reads.
FOUR OF THE NAMED ANOMALIES
• Homoglyph Spoofing — mixed-script lookalike domains, Punycode shown
• Negative Transit Latency — a hop timestamped before the one before it
• Sender Address Mismatch — the visible From against the actual Return-Path
• ARC Verdict: fail — the header the ARC verdict comes from records arc=fail
ROUTING AND VOLUME
Every Received: hop in order, with geolocation when lookups are on. Run whole directories, or open a .mbox and analyze every message inside it.
ON-DEVICE LANGUAGE SCAN
Apple's NaturalLanguage framework, on device with no network, flags social-engineering and business email compromise phrasing, one explainable row per match. English lexicon today, and the app says so rather than reporting "clean" for a language it cannot read.
THE NETWORK, NAMED
Three outside services, each named, each switchable, all cut off by one Zero Telemetry toggle:
• ipwho.is — hop geolocation
• rdap.org — domain age over HTTPS, redirected to the domain's registry
• www.virustotal.com — attachment hash reputation, your own free key
A registry link opens search.arin.net in your browser, not in the app. HeaderLume itself contacts nothing else. To draw the routing map, macOS may request Apple Maps imagery for the area where the hops resolved; with Zero Telemetry on or map geolocation off, no map is drawn for ordinary mail. No analytics, no crash reporting, no accounts, no third-party SDKs. Sandboxed.
ACCESSIBILITY
VoiceOver spells out S-P-F, D-K-I-M, D-M-A-R-C and A-R-C in the analyzer. Full dark mode.
15 languages. macOS 14 and later, universal.
PURCHASE
Analysis, bulk and .mbox runs, and every export including the certificate require an auto-renewable Premium Annual subscription or a one-time Genesis Partner License. The free download lets you explore the interface. The subscription renews automatically unless auto-renew is turned off at least 24 hours before the period ends; manage it in Apple Account settings.
Terms of Use: https://profworkbench.com/#terms
Ratings & Reviews
- This app hasn’t received enough ratings or reviews to display an overview.
THE CERTIFICATE CARRIES THE MESSAGE
The certificate can now embed the original message inside the PDF as a real file attachment, and prints MD5, SHA-1 and SHA-256 of those exact bytes. Attaching is a choice on every export. Long Received: headers now print in full.
AUTHENTICATION READ BEFORE DECODING
SPF, DKIM, DMARC and ARC verdicts are now read from the file's raw bytes, before any decoding.
ALSO
An on-device language scan replaces the keyword matcher. VoiceOver spells out the acronyms. The e-discovery ZIP adds Concordance DAT and Opticon OPT.
The developer, ProfWorkBench, LLC, indicated that the app’s privacy practices may include handling of data as described below. For more information, see the developer’s privacy policy .
Data Not Collected
The developer does not collect any data from this app.
The developer indicated that this app supports the following accessibility features. Learn More
For more information, visit the developer’s accessibility website .
Information
- Seller
- ProfWorkBench, LLC
- Size
- 3 MB
- Category
- Utilities
- Compatibility
Requires macOS 14.0 or later.
- Mac
Requires macOS 14.0 or later.
- Mac
- Languages
English and 14 more
- English, Arabic, French, German, Hebrew, Hindi, Italian, Japanese, Korean, Portuguese, Russian, Simplified Chinese, Spanish, Traditional Chinese, Turkish
- Age Rating
4+
- 4+
- In-App Purchases
Yes
- Genesis Partner License $999.99
- Premium (Annual) $199.99
- Copyright
- © 2026 ProfWorkBench, LLC
