Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing. Use when triaging a suspicious or reported email, investigating a phishing incident, or verifying w

Analyzing Email Headers for Phishing Investigation When to Use When investigating a suspected phishing email to determine its true origin For verifying sender authenticity and detecting email spoofing During incident response when a user has clicked a phishing link When tracing the delivery path and relay servers of a suspicious email For validating SPF, DKIM, and DMARC alignment to identify forgery Prerequisites Raw email headers from the suspicious message (EML or MSG format) Understanding of SMTP protocol and email header fields Access to DNS lookup tools (dig, nslookup) for SPF/DKIM/DMARC verification Email header analysis tools (MHA, emailheaders.net concepts) Python with email parsing libraries for automated analysis Access to threat intelligence platforms for IP/domain reputation Workflow Step 1: Extract Raw Email Headers Step 2: Parse the Email Header Chain Step 3: Validate SPF, DKIM, and DMARC Records Step 4: Analyze Sender Domain and Infrastructure Step 5: Examine Email Body and Attachments Key Concepts Concept Description SPF (Sender Policy Framework) DNS record specifying authorized mail servers for a domain DKIM (DomainKeys Identified Mail) Cryptographic signature verifying email content integrity DMARC Policy framework combining SPF and DKIM for sender authentication Received headers Server added headers showing each hop in the delivery chain (read bottom to top) Return Path Envelope sender address used for bounce messages; may differ from From Message ID Unique identifier assigned by the originating mail server X Originating IP Original sender IP address (added by some mail services) Header forgery Attackers can forge From, Reply To, and other headers but not Received chains Tools & Systems Tool Purpose MXToolbox Online email header analyzer and DNS lookup dig/nslookup DNS record queries for SPF, DKIM, DMARC verification pyspf Python SPF record validation library dkimpy Python DKIM signature verification library PhishTool Specialized phishing email analysis platform VirusTotal URL and file reputation checking service AbuseIPDB IP address reputation database whois Domain registration information lookup Common Scenarios Scenario 1: CEO Fraud / Business Email Compromise The email claims to be from the CEO but Reply To points to a Gmail address, SPF fails because the sending IP is not authorized for the spoofed domain, DKIM is missing, and the From domain is a lookalike (ceo company.com vs company.com). Scenario 2: Credential Harvesting Phishing Email contains a link that displays "login.microsoft.com" but href points to a lookalike domain, the attachment is an HTML file containing a fake login page with credential exfiltration JavaScript, the sending domain was registered 3 days ago. Scenario 3: Malware Delivery via Attachment Email with an Office document attachment containing macros, the sender domain passes SPF but the account was compromised, DKIM signature is valid (sent from legitimate infrastructure), attachment SHA 256 matches known malware on VirusTotal. Scenario 4: Spear Phishing with Legitimate Service Attacker uses a legitimate email marketing service to send phishing, SPF and DKIM pass because the service is authorized, the phishing is in the content not the infrastructure, requires URL and content analysis rather than header authentication checks. Output Format

analyzing-email-headers-for-phishing-investigation