How to Analyze Email Headers for Phishing
To analyze email headers for phishing, open the raw header and check four things. First, the Authentication-Results line for SPF, DKIM and DMARC. Second, whether the From address matches the Return-Path. Third, the Received lines, read bottom to top, to find the real sending IP. Fourth, whether the Message-ID domain fits the sender. A “fail” or a mismatch is a red flag.
A phishing email can copy a logo, a signature and a tone of voice perfectly. It cannot easily fake the trail of servers that handled it. That trail lives in the header. Once you know how to analyze email headers for phishing, you can judge a suspicious message in about five minutes, even when the body looks flawless. A dedicated tool like Freeviewer Email Converter Tool lets you view the header safely, without opening links or attachments.
What Is an Email Header?
An email header is the hidden block of technical lines above the message body. It records who sent the email, which servers passed it along, and whether it passed security checks. Your email app shows only a few lines, such as From, To, Subject and Date. The raw header holds much more.
Why You Should Analyze Email Headers for Phishing
Filters miss things. Attackers use fresh domains, hacked real accounts and tools that pass basic checks. The header gives you evidence, not a guess. It also helps you:
- Confirm if a sender is spoofed or genuine
- Find the real origin IP and hosting provider
- Build proof for IT, legal or law enforcement
- Learn the pattern, so the next attack is easier to spot
The Header Fields That Matter Most
- From: What you see. Easy to fake.
- Return-Path: Where bounces go. This is the envelope sender.
- Reply-To: Where your reply will really go.
- Received: One line added by each server. This is your trail.
- Authentication-Results: The SPF, DKIM and DMARC verdict.
- Message-ID: A unique ID. Its domain should make sense.
- X-Originating-IP: The sender’s IP, if present.
Step-by-Step: How to Read Email Headers for Phishing
Here is the six-step method to analyze email headers for phishing.
Step 1: Extract the Raw Email Headers
Every email app has an option like “View source,” “Show original” or “Message properties.” Copy the full header into a plain text file.
Most common error: Forwarding the email inline. This strips the original header. Forward it as an attachment (.eml) or save it as a file instead.
Step 2: Check Email Authentication Results
Find the Authentication-Results line. You will see three checks:
- SPF: Did the sending IP have permission to send for that domain?
- DKIM: Is the digital signature valid and unaltered?
- DMARC: Do SPF or DKIM line up with the visible From domain? This is the DMARC alignment check.
Results read pass, fail, softfail, neutral or none. To run an SPF record lookup, query the domain’s TXT record with a command like nslookup -type=txt example.com. For DKIM signature verification, take the d= (domain) and s= (selector) values from the DKIM-Signature line and look up selector._domainkey.domain in DNS. The standards are public: SPF (RFC 7208), DKIM (RFC 6376) and DMARC (RFC 7489).
Most common error: Thinking “SPF pass” means safe. A scammer can register a lookalike domain, set up SPF correctly, and pass. Always check whose domain passed.
Step 3: Compare From, Return-Path and Reply-To
A Return-Path vs From address mismatch is a classic sign of envelope sender spoofing. The visible Form says [email protected], but the Return-Path points to a random domain. A different Reply-To is also suspicious, because it quietly sends your answer to the attacker.
Most common error: Flagging every mismatch. Newsletters and ticket systems legitimately send from one domain for another. A mismatch plus a failed DMARC plus urgent wording is what matters.
Step 4: Trace the Received Headers
Read Received lines from the bottom up. The bottom line is the first server that touched the message. Each line above it is the next hop. Note the IP in the first external hop, then run an email sender IP lookup. Check its country, hosting provider, reverse DNS and any blocklist listing. Example (documentation IP range):
Received: from mail.fake-bank-alerts.example ([203.0.113.45])
by mx.yourcompany.example; Wed, 11 Nov 2026 03:12:08 +0000
Most common error: Trusting every Received line. Attackers can inject fake ones at the bottom. Only the lines added by your own mail servers are fully reliable.
Step 5: Check the Message-ID
The Message-ID usually ends in the sending system’s domain. If an email claims to be from a known company but the Message-ID shows a strange or unrelated domain, treat it as possible Message-ID spoofing. Also check that the Date field is believable and the time zone fits the claimed sender.
Most common error: Ignoring it. Many people skip the Message-ID, yet it often exposes bulk-mailer tools.
Step 6: Check the Domain Itself
Look for lookalike spelling (rn instead of m, a zero for the letter O). Run a WHOIS lookup. A domain registered a few days ago, sending “urgent” mail, is highly suspicious.
Most common error: Reading the display name only. Always read the actual address.
Limitations of Manual Method to Analyzing Email Headers for Phishing
Checking headers by hand works for one or two emails, but it gets hard fast. Raw headers are long and full of technical lines, so it is easy to misread them or miss a clue. It is also slow. If you have to check a whole mailbox or a pile of reported emails, the manual way simply doesn’t scale.
It also depends on the person doing it. Someone with little technical knowledge may not know what a failed DMARC or a strange Received line really means, and two people can reach different answers on the same email. There is a safety risk too. If you open the suspicious email in your normal inbox just to copy the header, you may load hidden images or expose yourself to harmful links.
Finally, headers can be faked. Some lines can be forged, and forwarding can break SPF and DKIM, so a failed check does not always mean an attack.
Phishing Email Header Example: What Bad Looks Like
A typical phishing header often shows: spf=fail, dkim=none, dmarc=fail, a From domain that differs from the Return-Path, a Reply-To on a free mailbox, and a first hop from an unrelated hosting IP. One flag is a warning. Three flags together are your answer.
How to Analyze Email Headers for Phishing with Professional Tool
Reading headers one email at a time works for a single message. It breaks down when you have a whole mailbox file, a complaint queue, or evidence you must not alter. This is where the email conversion tool fits. It is a Windows tool that opens mailbox files and shows each email in several views, including a Message Header view, MIME view, Hex view and Properties view. It supports many formats, such as PST, OST, MBOX, MSG, EML, NSF and EDB, and you don’t need a mail client installed.
Steps to use it:
Step 1: Install and set up
Step 2: Activate the tool
Step 3: Click Scan File, or use Auto Search to find mailbox files on a drive.
Step 4: Pick the file type (PST, MBOX, MSG, EML and so on) and load it.
Step 5: Wait for the folder tree and email list to load. Note the MD5 value shown for each message. It helps prove the evidence was not changed.
Step 6: Click the suspicious email, then open Message Header View to see Message-ID, X-Priority, Content-Type and the other raw fields.
Step 7: Use Advanced Search (From, To, Subject, dates, attachment) to find every email from the same sender or
Step 8: Export the message list to CSV, or save emails as PDF, EML or HTML for your report.
Most common error: Opening the original file in a live mail client, which can change flags or trigger remote content. Work from a read-only copy.
Limitations of the Automated Tool
A professional tool makes the work faster and safer, but it has limits too.
- Setup is needed. Your PC needs .NET Framework 4.6.1 and the VC++ 2015 and 2010 packages. The install also asks for your machine username and password.
- You must activate it. You need an activation code before you can create a case.
- Some files are not supported. For Lotus Notes files, Lotus Notes must be installed. Encrypted NSF files are not supported.
- Some settings are fixed. The case storage path can only be changed before you create the case.
- Some export formats are limited. EML, HTML Reporter and TIFF exports work only for emails, not calendar items.
- You still need to judge. The guide shows the header tab, but it doesn’t show the tool calling an email “phishing.” You still have to read the SPF, DKIM and DMARC results and decide for yourself.
Scenarios to Analyze Email Headers for Phishing
- Spear phishing: To analyze email headers for phishing aimed at one person, expect clean grammar and a believable sender. Check for a new lookalike domain, a Reply-To switch, and a sending IP that doesn’t match the real company.
- Business Email Compromise (BEC): When you analyze email headers for phishing that look like BEC, remember there are two types. A spoofed one fails DMARC. A compromised real account passes everything, so look at the Received path, a sudden new IP or country, a new forwarding rule, and a changed Reply-To on a payment request. If money is involved, call your bank first.
- Forwarded or list mail: Forwarding and mailing lists can break DKIM or SPF without any attack. Check ARC results if present.
- Spoofed internal sender: If “the CEO” emails you but the first hop is external, it’s spoofed.
- Email forensics and investigation: Keep the original file, note the hash, and record every step. Do not edit headers.
FAQs
Q1. What is the fastest way to analyze email headers for phishing?
Answer. Check the Authentication-Results line first, then compare From and Return-Path. This takes under two minutes.
Q2. Can a phishing email pass SPF, DKIM and DMARC?
Answer. Yes. If the attacker owns the lookalike domain or has hacked a real account, all three can pass.
Q3. Where do I find the sender’s real IP?
Answer. In the lowest external Received line, or X-Originating-IP if present. Then do an IP lookup.
Q4. Is an online header analyzer safe?
Answer. Fine for low-risk mail. For confidential cases, use an offline tool.
Final Thoughts
Learning to analyze email headers for phishing turns “this feels off” into proof. Check authentication, compare the addresses, trace the hops, verify the Message-ID and inspect the domain. For single emails, a text editor is enough. For mailbox files, a read-only viewer saves hours.