How to Read Email Headers to Spot a Phishing Attempt

Attackers can easily clone corporate HTML templates, upload official logos, and forge the display name in your inbox. What they cannot forge without leaving direct forensic evidence is the raw technical metadata appended to every transmission. Learning how to read email headers phishing campaigns rely on gives you an unvarnished look at a message's true origin, intermediate relays, and security authentication status.

To read an email header for phishing indicators, extract the raw header text from your email client, compare the user-facing From: domain against the envelope Return-Path:, trace the originating IP in the lowest Received: entry, and check Authentication-Results: for explicit SPF, DKIM, or DMARC failures.

---

How to Extract Raw Headers in Major Email Clients

Email clients collapse raw headers by default to keep user interfaces clean. Before performing forensic analysis, you must expose the raw text block.

Gmail (Web)

1. Open the suspicious message in your browser.
2. Click the three vertical dots (More) next to the top-right Reply button.
3. Click Show original. The full header block will load in a new browser tab.

Outlook (Web / Office 365)

1. Open the email message.
2. Click the three dots (...) on the top action bar inside the message pane.
3. Select View, then click View message details. Copy the entire text block from the popup.

Outlook (Classic Desktop Application)

1. Double-click the message to launch it in a standalone window.
2. Navigate to File > Properties.
3. Copy the plain text inside the Internet headers field at the bottom of the window.

Apple Mail (macOS)

1. Highlight the target message in your inbox.
2. Click View in the top menu bar, hover over Message, and choose All Headers (or press Command + Shift + H).

Yahoo Mail (Web)

1. Open the incoming message.
2. Click the More icon (three dots ...) on the top toolbar.
3. Select View raw message.

---

The 5 Key Header Fields Used to Detect Phishing

Raw headers consist of key-value pairs separated by colons, recorded chronologically as the message travels across the network. When auditing an email, focus on these five core directives:

1. From: vs. Return-Path:

The From: header controls what human eyes see in the inbox interface (e.g., Billing <[email protected]>). However, underlying mail transfer agents (MTAs) route bounce logs using the Return-Path: header (the envelope sender).

Legitimate platforms align these domains or use recognized parent infrastructure. Basic spoofing attacks display a legitimate brand in the From: field while the Return-Path: reveals an unrelated address like [email protected].

2. Authentication-Results:

Receiving email servers execute automated validation checks upon receipt and output their verdicts into this line.

• SPF (Sender Policy Framework): Confirms if the sending server's IP address is authorized within the sender domain's DNS records.
• DKIM (DomainKeys Identified Mail): Validates a cryptographic header signature to confirm the message content was not altered in transit.
• DMARC (Domain-based Message Authentication): Verifies that the domain in the From: header matches SPF and DKIM domain alignments.

Look for explicit flags like spf=fail, dkim=fail, or dmarc=fail. To learn how public keys sign these message payloads at a cryptographic level, read our detailed guide on what DKIM is and how email signing actually works.

3. Received:

Every MTA that handles a message appends a Received: line at the very top of the existing header stack. Consequently, header routing history reads from bottom to top:

• The bottom Received: line identifies the original server that generated or injected the email.
• The top Received: line logs the exact moment your primary email provider received the payload.

Because attackers frequently route phishing through breached WordPress sites or residential proxies, inspecting the lowest Received: line reveals the actual originating IP address.

4. Reply-To:

An optional directive that dictates where automated response emails land when a recipient clicks "Reply." Scammers frequently spoof a legitimate corporate address in From:, but specify an attacker-controlled address inside Reply-To: to capture incoming responses.

5. Message-ID:

A unique string assigned by the generating mail server (e.g., <[email protected]>). The domain structure after the @ symbol inside the angle brackets should reflect the legitimate sending entity rather than a mismatched public webmail domain.

---

Step-by-Step Triage: Auditing Headers for Spoofing

Follow this four-step forensic protocol when evaluating suspicious inbox traffic:

1. Extract and parse the raw payload. Copy the raw header block out of your client. Manually parsing hundreds of lines of raw text invites human error. Paste raw headers into our free email header analyser to immediately map server hops, flag domain mismatches, and isolate authentication results.

2. Verify envelope alignment. Locate From: and Return-Path:. If the primary organizational domain in Return-Path: does not match the domain shown in From:, flag the email as high risk.

3. Check domain authentication verdicts. Scan Authentication-Results: for SPF, DKIM, and DMARC status outputs. If you observe spf=fail or spf=softfail, the sending server IP was never authorized by the real domain owner. For step-by-step instructions on verifying these DNS records manually, consult our guide on how to check SPF, DKIM, and DMARC for any domain.

4. Isolate the originating IP address. Scroll down to the lowest Received: entry. Identify the IP address listed inside square brackets after received from (e.g., [198.51.100.24]). Perform a WHOIS lookup or reverse DNS search on that IP. If the address belongs to an unrelated hosting provider, cloud service, or overseas ISP, the sender's identity is forged.

---

Technical Edge Cases: Where Headers Can Mislead You

Header analysis is an essential defensive tool, but it does not guarantee total protection. Be aware of these tactical scenarios where headers pass technical checks despite malicious intent:

• Account Takeover (ATO): If an attacker steals valid employee credentials, they can dispatch phishing emails directly through the victim organization's genuine mail infrastructure. Because the authentic servers generated the payload, SPF, DKIM, and DMARC will pass perfectly.
• Lookalike and Typosquatted Domains: Attackers frequently register domains that mimic real brands (e.g., paypa1.com instead of paypal.com). If the attacker configures valid SPF and DKIM records for paypa1.com, authentication checks will show pass. You must scrutinize the exact domain spelling.
• Open Redirects and Malicious Links: A header audit only evaluates message transport—it does not sanitize embedded URLs. An email can pass every header check while containing links that redirect recipients through high-reputation domains to credential harvesting pages.

---

Practical Rules: When to Audit vs. When to Purge

Inspecting raw code line-by-line requires time. Apply this decision matrix to determine whether a manual header review is necessary:

Perform Header Analysis When:

• You receive a urgent security or financial notification from an account you hold, but the phrasing or context raises red flags.
• An email from a known vendor or executive requests an abrupt change to payment details, wiring instructions, or credentials.
• You need to document technical evidence to lodge an abuse report with a hosting provider or internal security team.

Immediately Delete or Report When:

• The email lands straight in your Spam or Junk folder. Your provider's system filters have already isolated the risk.
• The email targets an address you never registered with that service.
• The message contains generic spam markers, unexpected binary attachments (.iso, .exe, .zip), or demands immediate cryptocurrency ransom. Delete these immediately without opening headers.

---

Eliminating Exposure at the Source

The most reliable way to mitigate phishing threats is to reduce the footprint of your primary email address. Every public form, software download, and retail account created using your main address exposes that inbox to third-party data breaches and automated harvesting lists.

Using a disposable email address for non-critical signups insulates your primary inbox from marketing spam and targeted credential harvesting campaigns. When testing unverified online services, requesting whitepapers, or creating forum accounts, deploy a throwaway inbox instead.

If a third-party service suffers a database breach, attackers only obtain an expired temporary address, keeping your primary email address off malicious mailing lists. Browse our comprehensive directory of privacy tools on our email tools page.

For immediate, hassle-free address generation, Best-TempMail provides clean temporary inboxes that require no registration and update instantly when incoming verification codes arrive.

---

Frequently Asked Questions

How do I locate the originating IP address in an email header?

Scroll to the very bottom of the raw header block to find the earliest Received: entry. Look for the phrase received from followed by an IP address enclosed in square brackets. That address identifies the initial mail server that injected the message into the network.

What is the exact difference between From: and Return-Path:?

The From: header is a user-facing metadata line rendered by your email client's interface. The Return-Path: header is an operational routing parameter that dictates where receiving mail servers must deliver bounce messages and delivery status notifications. Phishing attempts routinely feature mismatched values across these two fields.

Can an attacker forge Received: headers in a phishing email?

An attacker can insert fake Received: lines into the header text before sending a message. However, they cannot modify or forge the Received: headers added by legitimate downstream relays and your own mail provider. By tracing headers from the bottom up, you can pinpoint where forged entries end and verified server hops begin.

Why does an email pass SPF and DKIM but still look like phishing?

An email passes authentication checks if the attacker sends it from a domain they own (such as login-verify-bank.com) with correctly configured SPF and DKIM records. While the cryptographic and IP checks pass, the domain itself is fraudulent. Always check the domain name against the official domain of the organization claiming to contact you. To learn how websites analyze temporary inboxes, read our guide on how websites detect temporary email addresses.