EMLX (.emlx)

.emlx file signature | message/x-emlx

EMLX is an email message file format used by Apple Mail, created and maintained by Apple for macOS. It stores individual messages, including headers and body content, and is used for archiving, migration, and local mailbox storage within Mail and related Apple tools. The format is generally safe, though messages may contain attachments, embedded links, or other active content inherited from email, so untrusted files should be handled cautiously.

Safe

Magic Bytes

Offset 2


              0A 52 65 6C 61 79 2D 56 65 72 73 69 6F 6E 3A

Sources: Apache Tika

All Known Signatures

10 signature variants are documented for .emlx files across multiple sources.

Hex Signature	Offset	Sources
0A 52 65 6C 61 79 2D 56 65 72 73 69 6F 6E 3A	2	Apache Tika
0A 23 21 20 72 6E 65 77 73	2	Apache Tika
0A 4E 23 21 20 72 6E 65 77 73	2	Apache Tika
0A 46 6F 72 77 61 72 64 20 74 6F	2	Apache Tika
0A 50 69 70 65 20 74 6F	2	Apache Tika
0A 52 65 74 75 72 6E 2D 50 61 74 68 3A	2	Apache Tika
0A 46 72 6F 6D 3A	2	Apache Tika
0A 52 65 63 65 69 76 65 64 3A	2	Apache Tika
0A 4D 65 73 73 61 67 65 2D 49 44 3A	2	Apache Tika
0A 44 61 74 65 3A	2	Apache Tika

Extension

.emlx

MIME Type

message/x-emlx

Byte Offset

Risk Level

Safe

Validation Code

How to validate .emlx files in Python

Python

def is_emlx(file_path: str) -> bool:
    """Check if file is a valid EMLX by magic bytes at offset 2."""
    signature = bytes([0x0A, 0x52, 0x65, 0x6C, 0x61, 0x79, 0x2D, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A])
    with open(file_path, "rb") as f:
        f.seek(2)
        return f.read(15) == signature

How to validate .emlx files in Node.js

Node.js

function isEMLX(buffer: Buffer): boolean {
  const signature = Buffer.from([0x0A, 0x52, 0x65, 0x6C, 0x61, 0x79, 0x2D, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A]);
  if (buffer.length < 17) return false;
  return buffer.subarray(2, 17).equals(signature);
}

How to validate .emlx files in Go

func IsEMLX(data []byte) bool {
    signature := []byte{0x0A, 0x52, 0x65, 0x6C, 0x61, 0x79, 0x2D, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A}
    if len(data) < 17 {
        return false
    }
    return bytes.Equal(data[2:17], signature)
}

API Endpoint

GET /api/v1/emlx


              curl https://filesignature.org/api/v1/emlx

See the full API documentation for all endpoints and parameters.

Frequently Asked Questions

What is a .emlx file?

A .emlx file is identified by the magic bytes 0A 52 65 6C 61 79 2D 56 65 72 73 69 6F 6E 3A at byte offset 2. EMLX is an email message file format used by Apple Mail, created and maintained by Apple for macOS. It stores individual messages, including headers and body content, and is used for archiving, migration, and local mailbox storage within Mail and related Apple tools. The format is generally safe, though messages may contain attachments, embedded links, or other active content inherited from email, so untrusted files should be handled cautiously.

What are the magic bytes for .emlx files?

The magic bytes for EMLX files are 0A 52 65 6C 61 79 2D 56 65 72 73 69 6F 6E 3A at byte offset 2. These bytes uniquely identify the file format regardless of the file extension.

How do I validate a .emlx file?

To validate a .emlx file, read the first bytes of the file and compare them against the known magic bytes (0A 52 65 6C 61 79 2D 56 65 72 73 69 6F 6E 3A) at offset 2. This is more reliable than checking the file extension alone, as extensions can be renamed.

What is the MIME type for .emlx files?

The primary MIME type for .emlx files is message/x-emlx.

Is it safe to open .emlx files?

EMLX (.emlx) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.