generatepassword.eu

How to read e-mail headers and spot phishing

7 min read · Published · Password and DNS Toolbox

Short answer

Open the message source and look at the top-most Authentication-Results header, which your own provider added: dmarc=pass means the visible From domain is genuine. Then check that Reply-To goes to the same organisation and that the domain is not a look-alike. Everything lower in the headers could have been written by the sender.

Key points

  • Trust only the headers your own provider added (the top ones).
  • dmarc=pass proves the From domain, not that the sender is honest — check for look-alike domains.
  • A Reply-To pointing elsewhere is a classic invoice-fraud sign.

Get the raw headers

  • Gmail: ⋮ menu → Show original.
  • Outlook on the web: … → View → View message source.
  • Outlook desktop: File → Properties → Internet headers.
  • Apple Mail: View → Message → All Headers.

Paste them into the e-mail header analyzer. Headers are processed in memory and not stored.

Read from the bottom up — but trust from the top

Each server adds a Received line at the top, so the bottom line is the oldest. The lines added by your own provider are trustworthy; anything below the point where the message entered your provider could be invented by the sender. The analyzer shows the path in chronological order with delays between hops.

Authentication-Results: the key line

Authentication-Results: mx.google.com;
  dkim=pass header.i=@example.com;
  spf=pass smtp.mailfrom=bounce@mail.example.com;
  dmarc=pass header.from=example.com
  • dmarc=pass — the domain in the From line is authenticated.
  • dmarc=fail — the From domain was not authenticated. Common in spoofing; also in misconfigured senders.
  • spf=softfail/fail alone is weak evidence — forwarding breaks SPF.

Warning signs worth a closer look

  • A Reply-To on a different domain than From (answers go to the attacker).
  • A From domain that looks like a real one: paypa1.com, example-support.com, extra subdomains. Check its age with the WHOIS lookup — phishing domains are often days old.
  • DKIM signed by an unrelated domain and DMARC failing.
  • Links whose real target differs from the displayed text — hover before clicking, or test them with the redirect checker.

None of these is proof on its own. When in doubt, contact the organisation through a channel you already know.

Frequently asked questions

Can the From address be faked?

Yes. Without DMARC enforcement by the sender's domain, anyone can put any address in From. DMARC results show whether it was authenticated.

Does dmarc=pass mean an e-mail is safe?

It means the domain is genuine. Attackers also register their own look-alike domains, which can pass DMARC.

What is ARC?

ARC records authentication results seen by forwarders and mailing lists before they changed the message.

Sources