Email Header Validator

Overview

Nothing here is sent and nothing is connected to. We read the headers you hand us and check their syntax and your policy, and that is the whole of it: we cannot tell you whether a domain exists, whether a mailbox is real, or whether your message will be delivered. The word validate invites exactly that assumption, so we say it plainly — no name is resolved, no mail exchanger is looked up, and a clean report means the headers are well formed, not that the mail will arrive. What you do get is three kinds of finding. What is missing, judged against a profile you pick or a list you supply. What is malformed: a value that carries a carriage return and therefore injects a second header, a date nothing can read, a message identifier with no domain half, a header that appears twice when it may appear once. And what is risky: a display name carrying a different address from the real one, a reply that would leave your domain, a blind copy alongside visible recipients, more recipients than you allow, and bulk mail with no way to unsubscribe. Every finding carries a severity, and a report is hygiene and policy — never a spam verdict and never an authentication result.

A header value that carries a carriage return does not look wrong until a receiving server reads everything after it as a header you never wrote, which is how a blind copy gets added to somebody else's message. Around that one check sit the quieter problems that cost you delivery rather than security: a date nothing can parse, a message identifier with no domain so threading breaks, two From headers so nobody agrees who sent it, bulk mail with no way out. All of them are decidable from the headers alone, and all of them are cheaper to catch here than in a postmaster's reply. Address syntax comes from the same engine our email-syntax skill uses, so an address judged valid here is valid everywhere on the platform.

When to use it

Scope

Non-goals

• Does not send, queue or relay a message, and opens no connection of any kind
• Does not resolve a domain, look up a mail exchanger, or confirm a mailbox exists, so a clean report never means the mail will be delivered
• Does not check SPF, DKIM or DMARC — those need name resolution and cryptographic verification, and we do neither
• Does not score a message for spam, and a clean report is not a reputation verdict
• Does not repair a header, reorder a set, or hand back a corrected message
• Does not read a message body or an attachment

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"communication.email_validate_headers","input":{"headers":[{"name":"From","value":"Northwind Orders <[email protected]>"},{"name":"To","value":"[email protected]"},{"name":"Date","value":"Tue, 28 Jul 2026 09:15:00 +0200"},{"name":"Message-ID","value":"<[email protected]>"}],"profile":"TRANSACTIONAL"}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("communication.email_validate_headers", {"headers":[{"name":"From","value":"Northwind Orders <[email protected]>"},{"name":"To","value":"Alice Whitfield <[email protected]>"},{"name":"Subject","value":"Your order 4417 has shipped"},{"name":"Date","value":"Tue, 28 Jul 2026 09:15:00 +0200"},{"name":"Message-ID","value":"<[email protected]>"}],"profile":"TRANSACTIONAL"});

Errors

Other limits

Limitations

• Does not send, queue or relay a message, and opens no connection of any kind
• Does not resolve a domain, look up a mail exchanger, or confirm a mailbox exists, so a clean report never means the mail will be delivered
• Does not check SPF, DKIM or DMARC — those need name resolution and cryptographic verification, and we do neither
• Does not score a message for spam, and a clean report is not a reputation verdict
• Does not repair a header, reorder a set, or hand back a corrected message
• Does not read a message body or an attachment
• Deciding whether an address can receive mail, which needs the network
• Judging whether a message is spam or whether its sender is authenticated
• Parsing a whole raw message into headers, body and attachments

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "communication.email_validate_headers",
  "input": {
    "headers": [
      {
        "name": "From",
        "value": "Northwind Orders <[email protected]>"
      },
      {
        "name": "To",
        "value": "Alice Whitfield <[email protected]>"
      },
      {
        "name": "Subject",
        "value": "Your order 4417 has shipped"
      },
      {
        "name": "Date",
        "value": "Tue, 28 Jul 2026 09:15:00 +0200"
      },
      {
        "name": "Message-ID",
        "value": "<[email protected]>"
      }
    ],
    "profile": "TRANSACTIONAL"
  }
}

Examples

{
  "headers": [
    {
      "name": "From",
      "value": "Northwind Orders <[email protected]>"
    },
    {
      "name": "To",
      "value": "Alice Whitfield <[email protected]>"
    },
    {
      "name": "Subject",
      "value": "Your order 4417 has shipped"
    },
    {
      "name": "Date",
      "value": "Tue, 28 Jul 2026 09:15:00 +0200"
    },
    {
      "name": "Message-ID",
      "value": "<[email protected]>"
    }
  ],
  "profile": "TRANSACTIONAL"
}

{
  "valid": true,
  "summary": {
    "profile": "TRANSACTIONAL",
    "truncated": false,
    "bySeverity": {},
    "headerCount": 5,
    "recipientCount": 1,
    "issueCount": 0
  },
  "resolvedRules": {
    "maxIssues": 1000,
    "checkListUnsubscribe": false,
    "requireTo": true,
    "requireFrom": true,
    "checkAddressSyntax": true,
    "forbidBccWithRecipients": false,
    "forbiddenHeaders": [],
    "requireDate": true,
    "requiredHeaders": [
      "From",
      "To",
      "Date",
      "Message-ID"
    ],
    "requireMessageId": true
  },
  "issues": []
}

{
  "profile": "MARKETING",
  "rules": {
    "maxRecipients": 50
  },
  "headers": [
    {
      "name": "From",
      "value": "\"Northwind Billing <[email protected]>\" <[email protected]>"
    },
    {
      "name": "To",
      "value": "[email protected]"
    },
    {
      "name": "Reply-To",
      "value": "[email protected]"
    },
    {
      "name": "Subject",
      "value": "Your July statement is ready\r\nBcc: [email protected]"
    },
    {
      "name": "Date",
      "value": "yesterday afternoon"
    },
    {
      "name": "Message-ID",
      "value": "<statement-july-2026>"
    }
  ]
}

{
  "valid": false,
  "summary": {
    "profile": "MARKETING",
    "truncated": false,
    "bySeverity": {
      "ERROR": 3,
      "WARNING": 3
    },
    "headerCount": 6,
    "recipientCount": 1,
    "issueCount": 6
  },
  "resolvedRules": {
    "requireDate": true,
    "requireTo": true,
    "requireFrom": true,
    "requiredHeaders": [
      "From",
      "To",
      "Date",
      "Message-ID"
    ],
    "requireMessageId": true,
    "checkListUnsubscribe": true,
    "forbiddenHeaders": [],
    "forbidBccWithRecipients": false,
    "maxRecipients": 50,
    "checkAddressSyntax": true,
    "maxIssues": 1000
  },
  "issues": [
    {
      "index": 3,
      "code": "HEADER_CONTROL_CHARACTER",
      "header": "Subject",
      "severity": "ERROR",
      "detail": "A carriage return, line feed or other control character sits at position 28 of the value. A receiving server reads that as the end of the header and the start of another one, which is how a header is injected."
    },
    {
      "index": 0,
      "code": "DISPLAY_NAME_SPOOF",
      "header": "From",
      "severity": "WARNING",
      "detail": "The display name contains an address of its own that is not the address the message is really from. A reader sees the display name and almost never the real one."
    },
    {
      "index": 2,
      "code": "REPLY_TO_DOMAIN_MISMATCH",
      "header": "Reply-To",
      "severity": "WARNING",
      "detail": "A reply to this message leaves the domain the message came from. That is normal for a helpdesk and it is also what a redirected reply looks like, so it is worth a look."
    },
    {
      "index": 5,
      "code": "MESSAGE_ID_INVALID",
      "header": "Message-ID",
      "severity": "ERROR",
      "detail": "A message identifier is a local part and a domain inside angle brackets. Without the domain half it is not globally unique, so threading and duplicate detection stop working."
    },
    {
      "index": 4,
      "code": "DATE_UNPARSEABLE",
      "header": "Date",
      "severity": "ERROR",
      "detail": "The value is not a date in the form a message uses, which looks like Tue, 28 Jul 2026 09:15:00 +0200. We never fall back to the current time, so an unreadable date stays unreadable."
    },
    {
      "code": "LIST_UNSUBSCRIBE_MISSING",
      "severity": "WARNING",
      "header": "List-Unsubscribe",
      "detail": "Bulk mail without a one-click way out is filtered harder by the large mailbox providers, and in several places it is also a legal requirement."
    }
  ]
}

Recommended use cases

• Stop a header-injection attempt before a message is handed to a mail server, by refusing any value that carries a carriage return or a line feed
• Gate an outbound template in your build, so a missing Message-ID or an unparseable Date is caught long before a customer sees it
• Check a bulk campaign carries a List-Unsubscribe and stays inside your recipient policy
• Spot a display name carrying somebody else's address while reviewing suspicious mail

Avoid for

• Deciding whether an address can receive mail, which needs the network
• Judging whether a message is spam or whether its sender is authenticated
• Parsing a whole raw message into headers, body and attachments

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags