How to Analyze Email Headers Safely
Learn to read email headers to spot phishing: inspect From vs Reply-To, the Received chain, and Authentication-Results (SPF/DKIM/DMARC), all locally in your browser.
Quick Answer
To analyze an email header safely, compare From with Reply-To, review the Received chain, and check Authentication-Results for SPF, DKIM and DMARC — performing the analysis locally so the header is never shared.
Definition
Email header analysis is the review of RFC 5322 message headers to trace a message's path, verify sending authentication, and surface spoofing indicators.
Answer first
Check From vs Reply-To, then Authentication-Results, then the Received chain. Do it locally so the header never leaves your device.
What email headers are
Every email carries a set of RFC 5322 headers that record the message’s route, sender claims, authentication verdicts and metadata. The fields that matter for investigation are:
| Field | What it tells you |
|---|---|
From | The display identity the recipient sees — attacker-controlled, easily spoofed |
Reply-To | Where a reply is actually routed — a classic redirection trick |
Return-Path / Envelope-From | The envelope sender used during SMTP delivery, checked against SPF |
Received | One line per hop; the path the message actually took |
Authentication-Results | Verdicts for spf=, dkim=, dmarc= computed by the receiving server |
Message-ID | A unique identifier; patterns inconsistent with the claimed sender are suspicious |
Received-SPF / DKIM-Signature | Raw authentication evidence inserted along the way |
1. How to get the header
Providers expose raw headers: Gmail “Show original”, Outlook “Properties”, Apple Mail “View → Raw Source”. Copy the complete header block.
2. Compare From and Reply-To
If Reply-To points somewhere different from From, replies diverge — a classic phishing tactic. Also compare From against Return-Path: mismatched envelope sender is an SPF fail waiting to happen.
3. Check authentication results
Read Authentication-Results for spf=, dkim=, dmarc= outcomes. Fails (spf=fail, dkim=fail, dmarc=fail) are strong signals of spoofed mail. Pass only means the domain authenticated — a compromised or attacker-registered domain can still pass.
4. Review the Received chain
Count hops and check the sequence: each Received line should show a plausible relay order from sender to your server. A missing or collapsed chain often indicates a truncated or hand-crafted message. Look for relays that don’t match the claimed sender’s infrastructure.
5. Follow suspicious content
Email headers point to where to look next, not the whole answer:
- Extract domains and URLs from the body → URL Analyzer and the Malicious URL Analysis Playbook
- Pull out sender domains and IPs → IOC Lookup and DNS Lookup
- Verify SPF/DMARC configuration of the claimed domain → Analyze DNS Records
6. Keep it private
Analyze the header in a local-only tool. Do not paste full headers into unknown online services.
Suspicious indicators checklist
Reply-ToorReturn-Pathdomain unrelated toFromdmarc=failorspf=failwith no compensating DKIM alignmentMessage-IDdomain inconsistent with the claimed sender- Received chain with implausible hops or timestamps
- Authentication verdicts that are missing (receivers that don’t publish DMARC)
Tools that help
- Email Header Analyzer — local, no upload.
- DNS Lookup — verify the domain’s SPF/DMARC configuration.
- URL Analyzer — inspect embedded URLs safely.
- IOC Lookup — check extracted sender/IP indicators.
Investigation path
Suspicious email
↓
Raw header
↓
From vs Reply-To / Return-Path
↓
SPF · DKIM · DMARC verdicts
↓
Received chain
↓
Extract domains · URLs · IPs
↓
URL Analyzer · DNS Lookup · IOC Lookup
↓
Phishing Defense ChecklistReferences
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.