Flour City Labs

Email Header Analyzer

The main piece. Send an email to and you'll get a reply within seconds: a plain-language report on how deliverable that message's sending domain really is.

Behind that reply, a Cloudflare Email Worker reads the message's headers and works through the hops and authentication results to trace the email's path. It then runs live DNS lookups on the sending domain and compares its published SPF, DKIM, DMARC, and MX records against how the message was actually sent.

That comparison catches a common quiet misconfiguration: a domain whose mail goes out through a service its own DNS records don't authorize, like a CRM, an invoicing tool, or a mailbox provider's "send as" feature. Those messages can still arrive, because authentication passes for the sending service's domain and many receivers accept that when the From domain publishes no enforced DMARC policy. It works until something changes: a stricter policy gets added, a receiver tightens its rules, or a new sender comes online. The live lookup is what makes the report complete, showing not just how this one message authenticated but what the domain's published records say should happen.

Two other ways to run it:

• Upload a .eml or .msg file on the site.
• Paste raw headers into the analyzer.

Both of those parse the headers right in your browser. The emailed check is the fuller one, since only it adds the live DNS comparison.

The report is built for two readers at once. A plain verdict up top answers "is my email set up right." The raw data sits underneath as proof for the technical reader: DNS records, Authentication-Results, and the Received chain with hop timing. A three-tier Pass / Warn / Fail system separates a low-stakes advisory like DMARC p=none from a real failure like a missing SPF record.

Architecture

One shared package does the actual work. The header parsing and deliverability checks live in email-core, a single zero-dependency module, and both surfaces import the same code: the in-browser analyzer and the Cloudflare email worker. One implementation, one set of behavior, two runtimes.

Around that core:

• Cloudflare Email Worker handles inbound mail. It runs on email ingest, does the analysis, and sends the reply through Resend. No server sitting idle.
• Supabase Edge Functions (written in TypeScript, running on Deno, a modern JavaScript/TypeScript runtime similar to Node.js) handle form submissions and the reply threading described below.
• React front end on Vercel hosts the marketing site, the analyzer, the forms, and the client dashboard.

The core parsing logic has an automated test suite covering SPF, DKIM, and DMARC pass and fail cases.

Client Project System

Clients get a dashboard at /profile that shows their project alongside a copy of every email reply to their form submission. It's currently wired up for 3D printing projects, with the email analyzer's reports coming to profiles next. The email threading behind it is the interesting part.

When a reply comes in to a project's tagged address (reply+{id}@), Cloudflare routes it to a Supabase function that pulls the project ID from the address, strips the quoted text, saves the message as a note, and forwards it to the client with the In-Reply-To and References headers that keep everything in the same email thread. Row-level security ties every note to a user, so one client never sees another's.

Wiring that routing together was a cross-service debugging exercise: reading logs and HTTP status codes across Cloudflare, the Supabase functions, and Resend to trace a request through all three and confirm each handoff.

Why I Built It

Flour City Labs was my way of strengthening my skills on a real, fully working project, and of demonstrating that pieces I'd worked with individually could run together as one production system, end to end. Standing up the email worker, the live DNS analysis, the database, and the reply threading taught me how these pieces fit together in production, and I'm now expanding the test suite that backs it.

I built it AI-assisted, using Claude Code and gstack, while owning the architecture and integration decisions. The work outside the codebase, the Cloudflare email routing and the Supabase configuration, I set up and verified by hand, and the automated test suite I added near the end is now part of how I review changes.

See It Live

The best way to judge it is to use it: email and a full report lands in your inbox within seconds.

flourcitylabs.com | Open the analyzer