# Email OSINT tools: where an address is registered and what its headers say

Free tools on the registry that check where an email address is registered, find related addresses, and read a message's headers and domain.

Published 25 Oct 2026 by OTInstaller.

To check where an email address is registered, run `ot run osintverse-community/holehe e:someone@example.com`:
holehe asks 120+ sites whether the address has an account, in ways that don't alert its owner, and lists the ones
that say yes. user-scanner covers 2,700+ sites and socialscan a shorter list of major platforms. When you have a
message rather than an address, email-header-parser reads its headers without going online, and checkdmarc and
dns-records check the domain it came from. None of these needs an API key, and all of them run with the same
command shape and save their results the same way.

## Where an address is registered

**[holehe](https://otinstaller.com/osintverse-community/holehe)** checks 120+ sites and prints the ones where the address is in use. On
sites with a forgotten-password function it sometimes shows a partly masked recovery phone number or address too.
On our test machine it checked 121 sites in 13 seconds.

```
ot run osintverse-community/holehe e:someone@example.com
```

Run against `example@example.com`, holehe reported 13 sites with an account. That is the first thing to know about
these results: a hit says an account exists with that address, not who made it, and many services let anyone sign
up with an address they never verify.

**[user-scanner](https://otinstaller.com/osintverse-community/user-scanner)** checks 2,700+ sites and services, for a username or an email
address. A full run usually takes about three minutes.

```
ot run osintverse-community/user-scanner e:someone@example.com
```

**[socialscan](https://otinstaller.com/osintverse-community/socialscan)** covers fewer platforms but uses their own availability checks. It
takes a username or an email address as one input called `query`:

```
ot run osintverse-community/socialscan --query someone@example.com
```

In our test run it answered for eight platforms in under three seconds, and two of the answers were rate-limit
errors. Two things to keep in mind when you read any of them, from the
[email investigation guide](https://otinstaller.com/guides/osintverse-community/email-investigation): a rate limit shows up as an error
(holehe marks it `[x]`), not as "not registered", so run it again later rather than treating it as a negative; and
masked recovery details can be compared with identifiers you already hold, but never unmasked through the site's
own recovery flow.

## Checks that don't notify the owner

A package's manifest can say whether the person you are looking into could notice a run (`notifies_target`), and the
tool page shows it next to whether the tool contacts the target, logs in to accounts or returns personal data:

- **holehe** declares that it does not notify the target.
- **user-scanner** declares the same, and its manifest explains how: the modules that may send the account owner an
  email or alert are skipped, because the package never passes `--allow-loud`.
- **hibp-breaches** and **hunter-domain-search** look the address or domain up in a provider's own database, and
  declare that they don't notify the target either.

None of the tools in this post contacts the target directly. What does alert an owner is going further by hand:
starting a password reset to see the masked recovery details in full sends them an email.

## Other addresses for the same person

- **[mailcat](https://otinstaller.com/osintverse-community/mailcat)** takes a nickname without the `@domain` and checks which of 25+ mail
  providers have an address with it: `ot run osintverse-community/mailcat u:janedoe`. Add `--provider proton` to
  check one provider.
- **[osgint](https://otinstaller.com/osintverse-community/osgint)** takes a GitHub username and finds the email addresses in that person's
  commits, with their public SSH and GPG keys. It uses GitHub's unauthenticated API, which allows 60 requests an
  hour per IP address.
- **[theharvester](https://otinstaller.com/osintverse-community/theharvester)** collects addresses, subdomains and hosts for a domain from
  public search engines and datasets. By default it uses only sources that need no key.
- **[hunter-domain-search](https://otinstaller.com/osintverse-community/hunter-domain-search)** lists the addresses Hunter has found for a
  domain, with names, positions and the address pattern. It needs a Hunter key; a free account includes a monthly
  allowance.
- **[hibp-breaches](https://otinstaller.com/osintverse-community/hibp-breaches)** lists the breaches an address appears in, with the date
  and the kinds of data exposed, never the data itself. It needs a paid Have I Been Pwned key.

When a tool needs a key, `ot` names it and where to get one, and `ot keys set HUNTER_API_KEY` keeps it in your OS
keychain.

## What the headers say

For a suspicious message, copy its full headers (in Gmail, **Show original**; in Outlook, **File**, **Properties**,
**Internet headers**) into `headers.txt` and run
[email-header-parser](https://otinstaller.com/osintverse-community/email-header-parser):

```
ot run osintverse-community/email-header-parser --headers "$(cat headers.txt)" -f table
```

In Windows PowerShell, use `--headers (Get-Content -Raw headers.txt)`. The tool runs with no network at all, so the
headers never leave your machine. For a short sample message it printed:

```
TYPE    VALUE                     SOURCE               CONFIDENCE
domain  example.org               email-header-parser  high
domain  example.net               email-header-parser  high
email   accounts@example.org      email-header-parser  high
email   billing-desk@example.net  email-header-parser  high
ip      93.184.216.34             email-header-parser  high
```

Each entity records the header it came from. Here the `From` address is at example.org but `Reply-To` is at
example.net, so replies would go somewhere else: a free-mail `Reply-To` on a company's `From` is a classic fraud
pattern. Without `-f table`, the JSON result also holds `hops`, the servers the message passed through with their
times, oldest first, and `auth`, the SPF, DKIM and DMARC results. A DMARC `fail` from a domain with a strict policy
is a strong sign of spoofing, and the first public IP in the hops is often the sender's mail server.

## The domain it came from

The part after the `@` tells you who runs the mailbox: a free provider, a company, or a domain someone registered for
the purpose.

```
ot run osintverse-community/checkdmarc d:example.com
ot run osintverse-community/dns-records d:example.com --types MX,TXT,NS
```

[checkdmarc](https://otinstaller.com/osintverse-community/checkdmarc) reports the domain's SPF, DMARC, MX, BIMI and DNSSEC records and what
is wrong with them. For `example.com` it found `v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s`, an SPF record of
`v=spf1 -all`, and a null MX record, which means the domain accepts no mail at all, so a reply would bounce. No
DMARC record, or `p=none`, means anyone can send as the domain and most receivers will accept it.
[dns-records](https://otinstaller.com/osintverse-community/dns-records) lists the raw records; TXT records often hold verification tokens
that show which services an organisation uses.

## All of it at once

```
ot playbook email-investigation e:someone@example.com d:example.com
```

The bundled playbook runs holehe and user-scanner on the address, and checkdmarc and dns-records on the domain, and
saves every run under one case. `ot guide read osintverse-community/email-investigation` opens the full guide in the
terminal, and [every tool that takes an email address](https://otinstaller.com/input/email) is listed on one page. For the username in the
address's local part, see [username search tools](https://otinstaller.com/blog/username-search-tools).