Email Header Forensics: Spotting Anomaly Routing and Spoofed Envelopes
A practitioner guide to inspecting Received headers, envelope sender vs. header From discrepancies, and message authentication results.
The Forensic Treasure Trove in Message Headers
When a suspicious email bypasses filters, the raw internet headers contain complete cryptographic and network telemetry detailing the true origin and journey of the message.
Deconstructing the 'Received:' Chain
'Received:' headers are prepended by each mail transfer agent (MTA) along the delivery path, read from bottom to top. Identifying the bottom-most untrusted server reveals the true originating IP address and network Autonomous System (ASN).
Validating Authentication-Results Headers
Look for the `Authentication-Results` header stamped by your receiving mail server. Verify whether SPF, DKIM, and DMARC evaluated to `pass`, `fail`, or `temperror`, and whether the RFC5322.From domain aligns with the RFC5321.MailFrom envelope address.
Related Articles & Advisories
SPF, DKIM & DMARC: Stopping Domain Spoofing and Executive Impersonation
Why traditional spam filters fail against spoofed domains, and how enforcing DMARC p=reject stops attackers from impersonating your executive team and company brand.
The Road to DMARC Enforcement: Migrating from p=none to p=reject Safely
A phased methodology for cataloging third-party senders, aligning cryptographic keys, and enforcing zero-tolerance rejection without dropping legitimate mail.
Business Email Compromise (BEC): Anatomy of Invoice Redirection Wire Fraud
How cybercriminals intercept supplier email threads, manipulate banking details, and siphon millions through synthetic invoice redirection.