Phishing Email Investigation Playbook — From Header to Verdict
Step-by-step phishing email investigation: read the headers, validate sender authentication (SPF/DKIM/DMARC), analyse sender and domain, dissect URLs safely, extract IOCs and decide next steps — using local tools only.
Quick Answer
To investigate a phishing email, pull the full headers, check From vs Reply-To and the Received chain, analyse SPF/DKIM/DMARC, validate the sender domain, inspect every URL locally without visiting it, extract IOCs, and only then decide whether the message is malicious or a false positive.
Definition
Phishing email investigation is the structured, evidence-first analysis of a suspicious message — headers, sender identity, domain, embedded URLs and indicators — performed without clicking links or contacting the sender.
Answer first
Investigate a phishing email in five steps: Pull headers → Check sender authentication → Analyse domains → Dissect URLs → Extract IOCs.
1. How phishing works
Phishing relies on impersonation and urgency. The message claims to be from a trusted party, pushes an action (login, payment, download), and the payoff is credential theft, malware, or business email compromise. Your job is to verify identity claims — not to guess intent — using the message’s own metadata.
Tactically this maps to MITRE ATT&CK T1566 (Phishing) and its sub-techniques: T1566.001 (spearphishing attachment), T1566.002 (spearphishing link) and T1566.003 (spearphishing via service). Naming the technique during triage gives the investigation a common vocabulary and helps you decide which indicators matter most.
2. Header analysis
Open the full raw headers (Show Original in mail clients; keep the complete header block). Focus on:
- From: the claimed sender.
- Reply-To: where replies actually go — a mismatch is a strong spoofing signal.
- Received chain: hop count and originating IP.
- Message-ID, Return-Path: correlation with From domain.
Paste the header block into the Email Header Analyzer. It extracts From / Reply-To / authentication results locally and flags mismatches. It never sends your header anywhere.
3. Sender validation
Check SPF, DKIM and DMARC results in the Authentication-Results header:
- SPF fail — the sending IP is not authorised for the From domain.
- DKIM fail — the message is not signed validly for a claimed domain.
- DMARC fail — neither SPF nor DKIM alignment passes; the message should be rejected under strict DMARC.
One failure is a signal, not a verdict: a legitimate mailing list can fail SPF yet pass DKIM. Correlate at least two checks before judging.
4. Domain analysis
Validate the domains involved with DNS Lookup: check MX/SPF/DMARC records of the From domain and confirm whether the domain is a newer, lookalike registration. A recently-created domain with a valid SPF that mismatches your providers is more suspicious than an established brand domain.
5. URL analysis — do not click
Extract every link from the email. In your mail client, copy the link target (hover or “copy link”) rather than clicking. Analyse each URL with URL Analyzer (structure local parse) and check reputation with the URL Reputation Checker. Look for:
- Non-HTTPS or mixed protocols.
- Embedded credentials or an
@in the hostname (lookalike trick). - A raw IP in the hostname.
- Domain that differs from the brand being impersonated.
A “clean” reputation means no known record — never a safety verdict.
6. IOC extraction
Extract indicators — sender domain, URLs, IPs, file hashes, bitcoin addresses — and normalise them with IOC Lookup. Defang values before sharing them in reports. Record what you found, even when intelligence has no record.
7. Investigation workflow
- Capture the raw message (EML) untouched.
- Analyse headers and authentication results.
- Validate domains and URLs with the tools above.
- Extract IOCs and check OpenTrojan intelligence.
- Decide: block-list the IOCs, notify the target user / security team, or close as a false positive — always with evidence recorded.
Start a new investigation to log header findings, IOCs, and the final verdict with references.
8. Indicators quick reference
- High: Reply-To differs from From + From domain has no policy; DMARC fail + lookalike URL.
- Medium: SPF fail alone, new domain, urgent action language.
- Low: HTML-only message, generic greeting, unsub domain matches From.
9. Mitigation
- Report to your provider’s abuse channel and your internal SOC.
- Block the sender domain and malicious URLs at the gateway.
- Educate the recipient — never punish a report.
10. Tools that help
- Email Header Analyzer — local header parse and flags.
- DNS Lookup — SPF/DMARC/MX records for the domains.
- URL Analyzer — local URL structure analysis.
- URL Reputation Checker — known-record check for domains/URLs.
- IOC Lookup — normalise, defang and check indicators.
- Investigation Workspace — track the case.
11. References
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.