Overview
Email headers carry the technical metadata that reveals a message's true origin and path. This lesson covers reading headers in phishing investigation.
Learning objectives
- Explain what email headers contain.
- Describe key headers for phishing analysis.
- Connect headers to authentication results.
Core concept
Email headers are the metadata at the top of an email recording its origin, path, and authentication — far more revealing than the visible From line. Key headers include: From (the claimed sender — easily spoofed), Return-Path and the actual sending server, Received headers (the chain of servers the message traversed, showing its true path), and authentication results (SPF, DKIM, DMARC) that indicate whether the sending server and message were authorized/verified for the claimed domain. In phishing investigation, headers are the primary technical evidence: they expose spoofing (the real origin differs from the claimed sender) and authentication failures. Reading headers turns a suspicious email into verifiable facts about where it really came from.
How it works
An analyst examines an email's headers to establish its true origin. The Received headers (read bottom-up) trace the servers the message passed through, revealing the actual originating server — which may contradict the claimed From domain (spoofing). Authentication headers are central: SPF checks whether the sending server is authorized to send for the envelope domain; DKIM verifies a cryptographic signature tying the message to the domain (integrity + origin); DMARC ties SPF/DKIM to the visible From domain with a policy. Failures (SPF fail, DKIM fail, DMARC fail) are strong phishing indicators — the message wasn't sent/authorized by the domain it claims. Headers also reveal mismatches (From vs Return-Path vs actual sender). Because the visible From is trivially forged but headers record technical reality, header analysis is the backbone of phishing investigation. Analysts correlate header findings with the other indicators (sender anomalies, URLs, attachments) for a verdict.
Practical example
Investigating a reported suspicious email, the analyst reads the headers. The visible From claims a well-known brand, but the Received chain shows the message actually originated from an unrelated server, and the authentication results show SPF and DMARC failed — the sending server was not authorized for the claimed domain. The Return-Path also mismatches the From. These header facts confirm spoofing: the email is not from who it claims. What looked plausible on the surface was exposed by the headers as a phishing attempt — showing headers as the primary technical evidence of a message's true origin.
Cybersecurity relevance
Email headers are the primary technical evidence in phishing investigation: because the visible From is trivially spoofed, headers reveal the true origin (via Received chains) and authentication results (SPF/DKIM/DMARC) that expose spoofing and unauthorized sending. Authentication failures are strong phishing indicators; origin mismatches (From vs Return-Path vs actual server) reveal deception. Header analysis grounds phishing verdicts in verifiable fact rather than surface appearance, and correlates with the other indicators (sender anomalies, URLs, attachments) covered in this module. It builds on email/DNS/crypto concepts from earlier paths. Reading headers is a core, foundational skill for the SOC's very common phishing investigations.
Common mistakes
- Trusting the visible From rather than verifying origin via headers/authentication.
- Not checking SPF/DKIM/DMARC results (missing strong spoofing indicators).
- Misreading the Received chain (read bottom-up) or ignoring From/Return-Path mismatches.
Key takeaways
- Email headers record a message's origin, path, and authentication — far more revealing than the easily-spoofed visible From.
- Key elements: Received chain (true path/origin), From/Return-Path/actual-server mismatches, and SPF/DKIM/DMARC authentication results; failures strongly indicate phishing.
- Headers are the primary technical evidence in phishing investigation, grounding verdicts in verifiable fact and correlating with sender, URL, and attachment indicators.
Check your understanding
- What do email headers reveal that the visible From does not?
- How do SPF, DKIM, and DMARC results help identify a spoofed/phishing email?