How to Run an Email OSINT Investigation: Proton Mail Lookups, Header Analysis, Attachment Metadata, and Claude Prompts

An email address has a birthday, and that birthday is evidence. When an anonymous tipster, a sockpuppet critic, or a too-convenient whistleblower shows up in an inbox, the first question is not only what they are saying. It is when the account came into existence, and what else was happening that week.

An inbox created the day after a court filing, a board vote, or a viral post tells a different story than one that has existed quietly for six years. Timing is context, and context is half the investigation.

This guide walks through how to estimate when a mailbox was created, starting with a Proton Mail lookup most people do not know exists, then covering Gmail, Outlook, Yahoo, iCloud, and Tuta. It also covers how to read raw mail headers, how to pull metadata out of attachments, and gives you copy-and-paste Claude prompts for your own work.

Proton Mail Is Private. Its Key Server Is Public.

Proton Mail is built for privacy. Messages between Proton users are end-to-end encrypted, Proton cannot read the mailbox, and the company does not hand out account details on request. That is exactly why people who want distance from their identity choose it.

End-to-end encryption, however, depends on public keys. For someone to send an encrypted message, their software has to find the recipient’s public key. Proton therefore runs a public key directory using the standard HKP keyserver protocol, and anyone can query it.

Every OpenPGP public key carries a creation timestamp. Proton generates a key when an address is set up, so for most accounts that timestamp lands within seconds of the account’s creation. The open-source researchers behind ProtOSINT and Prot1ntelligence documented this years ago.

How to Run a Proton Mail Creation-Date Lookup

https://api.protonmail.ch/pks/lookup?op=index&search=target@proton.me

info:1:1
pub:3a8f...e162fe:1:2048:1610409600::
uid:target@proton.me <target@proton.me>:1610409600::

The same query accepts @protonmail.com, @protonmail.ch, and @pm.me addresses, plus custom domains hosted on Proton. A hit on a custom domain reveals that an organization or person routes their mail through Proton, which is a finding in its own right.

Normalize the address before drawing conclusions. Proton ignores dots, hyphens, underscores, and anything after a plus sign, so jane.doe+tips@proton.me and janedoe@proton.me are the same mailbox and return the same timestamp.

Reading the Result Without Overreading It

The timestamp is the creation date of the address’s current primary key, not a certified account birth date. Treat it as firm for the key and probable for the account.

Beyond Proton: Dating Gmail, Outlook, Yahoo, iCloud, and Tuta Inboxes

Proton is unusual. The large free providers publish no creation date at all, so investigators estimate age from the outside in. The goal is a bracket: the earliest date the address can be proven to exist, and the latest date it could plausibly have been created.

Breach records give you a floor. Checking an address at Have I Been Pwned shows which breaches it appears in. An address in a 2016 breach existed by 2016. Zero breaches does not prove an account is new, but an address claiming a decade of history with no footprint anywhere deserves scrutiny.

Legacy domains are hints, not proof. A @hotmail.com, @me.com, or @mac.com address often points to an older account, because those suffixes were defaults in earlier eras. Providers have reopened and recycled suffixes over the years, so the domain is a nudge, never a date.

Registration traces show where the address lives. Open-source tools such as holehe and Epieos check which services an address is registered with. A mailbox registered nowhere except one forum and one tip line behaves very differently from one tied to shopping, streaming, and social accounts.

Custom domains carry their own paper trail. When the address sits on a domain someone controls, look up the domain’s WHOIS registration date and its first TLS certificate on crt.sh. A domain registered four days before the anonymous emails began is a timeline entry by itself.

The earliest message is evidence too. Ask the source for the first email they ever received from the address, and search the address in quotation marks on search engines, archive.org, and paste sites. The oldest dated appearance you can document becomes the outer edge of the bracket.

When the Inbox Was Born Matters as Much as What It Sends

A creation date on its own is trivia. Placed on a timeline, it becomes a question that can be tested. Investigators spend most of their attention on content, meaning what an account said, who it emailed, and what it attached. The circumstances of its birth often say more.

Once you have a date or a bracket, line it up against case events such as filings, hearings, arrests, rulings, and the dates records became public. Compare it with institutional events like board meetings, votes, contract awards, audits, elections, resignations, and FOIA responses. Check it against the subject’s own activity, including job changes, new or deleted social accounts, and falling-outs with former allies. Note media moments, such as when a story ran or went viral. Finally, look at other accounts in the same orbit, because several new addresses or profiles created within days of each other form a pattern rather than a coincidence.

Then ask the questions the date makes possible. Was the account created to respond to something? Did it exist before the event it claims to know about? Does its age fit the sender’s story of a long-time insider, a concerned neighbor, or a former employee?

How to Read Mail Headers

Headers are the envelope and postmarks of an email. They record which servers handled the message, when, and whether it passed authentication checks. The visible From line is just a label the sender typed, and headers are where it gets checked.

Get the raw headers

Ask sources to forward the original as an attachment (an .eml file) rather than a normal forward. A normal forward replaces the original headers with the forwarder’s and strips the evidence you need.

The fields that matter

A practical read order

Know what headers will not tell you

Proton, Gmail, Outlook.com, and most major webmail providers strip the sender’s own IP address from outgoing mail. The headers show the provider’s servers, not the person’s home connection. That is not a dead end. It means header analysis confirms the platform and the path, while person-level identification usually happens through legal process.

Free parsers such as MXToolbox’s header analyzer and Google’s Messageheader tool lay the chain out visually. They save time, but read the raw text yourself before citing anything.

Attachment Metadata Can Matter Just as Much

The email is the envelope. Attachments are what someone chose to put inside it, and they often carry a second layer of evidence the sender never thought about. A photo, a Word document, or a PDF can record who created it, on what device, with what software, and when, entirely independent of the email that delivered it.

Unlike most social media platforms, which strip metadata when files are uploaded, email generally passes attachments through untouched. That makes an emailed original one of the richest sources of file metadata an investigator will see.

How to pull it out

The fastest built-in option is the file properties panel: right-click and choose Properties on Windows, or Get Info on a Mac. For a complete view, the free command-line tool ExifTool reads nearly every format and shows every metadata group.

exiftool -a -G1 attachment.jpg

Office files are ZIP archives underneath. Renaming a copy from .docx to .zip and opening docProps/core.xml and docProps/app.xml reveals the author, last editor, revision number, timestamps, company, and editing time in plain text.

Preserve before you inspect

Save the original attachment straight from the .eml file, never a re-saved or re-exported copy, because opening and saving a file can overwrite its metadata. Record a SHA-256 hash of the untouched original so you can later show it has not changed.

sha256sum attachment.pdf            # macOS or Linux
Get-FileHash attachment.pdf         # Windows PowerShell

Claude Prompts for Your Own Email Investigations

These prompts are written to be pasted as-is. Swap in your own material where brackets appear. Redact personal data Claude does not need to see, and keep the original evidence untouched in your own files.

1. Parse a Proton key-server response

Here is the raw response from Proton's public key server for an address I'm researching:

[paste response]

Extract the key fingerprint, algorithm, key length, and creation timestamp. Convert the timestamp to UTC and to my local time zone. Tell me what the algorithm suggests about when or how the key was generated, and list every reason this date might not equal the account's creation date.

2. Walk through a raw header

I'm investigating the origin of an email. Below are the full raw headers. Do not assume anything the headers don't show.

[paste headers]

1. List every Received hop bottom-up as a table: hop number, from-server, by-server, IP, timestamp in UTC.
2. Identify the first hop added by a server I can trust and explain why.
3. Summarize SPF, DKIM, and DMARC results and which domain each authenticated.
4. Compare From, Return-Path, Reply-To, Message-ID domain, and DKIM d= domain. Flag mismatches.
5. Flag anything consistent with spoofing, forwarding, or a bulk-mail platform.
6. Separate what the headers prove from what they only suggest.

3. Build an age bracket for an address

I need to estimate when the email address [address] was created. Here is what I've found so far:

[breach results, earliest mentions, registration traces, domain WHOIS, earliest message date]

Build an age bracket: the earliest date I can document the address existing, and the latest plausible creation date. Rank each piece of evidence by strength, and tell me which gaps would most improve the estimate.

4. Read attachment metadata

Below is the full ExifTool output (or docProps XML) for a file attached to an email I'm investigating. The sender claims [the sender's story about the file].

[paste metadata]

List every date, name, device, software, and location field. Convert all dates to UTC. Identify anything that supports or contradicts the sender's story, flag fields that look edited or inconsistent with each other, and tell me what independent evidence would confirm each point.

5. Line the creation date up against events

An email account I'm researching was created on or about [date, time, time zone]. Here is a timeline of related events:

[paste dated events]

Place the account creation on the timeline. Identify events in the 30 days before and after. Suggest innocent and non-innocent explanations for the timing, and list the questions I should ask next to tell them apart. Don't treat proximity as proof.

6. Compare several suspect accounts

I have several email accounts that may be connected. For each I have a creation date or estimate, provider, key type if known, header details, and attachment metadata from messages they sent:

[paste account details]

Look for shared patterns: clustered creation dates, the same key algorithm, matching time-zone offsets, the same mail client, the same document author or device in attachments, similar naming conventions, or shared sending infrastructure. Rate how strongly each pattern suggests a common operator, and name what would weaken the link.

7. Write it up for the file

Turn my notes below into a neutral, factual investigative memo about an email account. Use plain language. Separate verified facts, reasonable inferences, and open questions into labeled sections. Include the date, method, and file hash for each lookup or extraction. Don't speculate about identity.

[paste notes]

Ethics and Limits

Everything in this guide relies on information that providers or the public internet publish openly. That does not make every use of it fair.

Protect sources first. Many people use Proton because they are afraid, so before running a lookup on a tipster, ask whether it is necessary, and think hard about what happens to the result if it could expose someone who came forward in good faith. Observe rather than pierce: no password resets to fish for recovery hints, no login guessing, and no social engineering of providers, all of which cross from research into intrusion and, often, crime. Corroborate before publishing, because a creation date or a metadata field is one data point from one system that can be wrong, reset, or misread. And remember that identity is a legal-process question. If you need to know who is behind an account, that answer comes through subpoenas and court orders, not OSINT guesswork.

Stay curious. Question everything. Follow the evidence.