Analyzing Phishing Email Headers

Overview

Email headers contain critical metadata that reveals the true origin, routing path, and authentication status of emails. Analyzing these headers is a foundational skill for identifying phishing attempts, verifying sender authenticity, and gathering threat intelligence. This skill covers systematic extraction and interpretation of email headers using both manual techniques and automated tools.

Prerequisites

• Basic understanding of SMTP protocol and email delivery
• Familiarity with DNS records (MX, TXT, SPF, DKIM, DMARC)
• Python 3.8+ installed
• Access to email client that can export raw headers (Outlook, Gmail, Thunderbird)

Key Concepts

Critical Header Fields

1. Received: Chain of mail servers the message passed through (read bottom to top)
2. From / Return-Path / Reply-To: Sender identity fields (often spoofed)
3. Authentication-Results: SPF, DKIM, DMARC verification outcomes
4. X-Originating-IP: Original sender IP address
5. Message-ID: Unique identifier; anomalies indicate spoofing
6. X-Mailer / User-Agent: Email client used to compose the message