Analyse Email Headers to Spot Phishing Attacks

Modern cybercriminals have evolved far beyond poorly written emails from fictional foreign princes. Today’s spear-phishing attacks are masterclasses in graphical deception. An email claiming your PayPal account has been restricted, or your Netflix subscription has expired, will feature perfectly cloned logos, identical typography, and completely flawless grammar. If you rely solely on your eyes to verify the legitimacy of a message, you will eventually fall victim to credential theft. The only definitive way to prove whether a message is genuine is to look past the graphical interface and examine the raw, underlying code. By learning how to identify a malicious phishing email by analysing email headers, you gain the ability to track the exact servers the message bounced through, allowing you to mathematically verify its true origin.

In this advanced cybersecurity guide, we will walk you through the process of exposing the hidden metadata attached to every email. We will explain how to extract these headers in popular webmail clients, and teach you how to read the vital `Received:` chain and Authentication-Results to expose digital forgery.

What is an Email Header?

When you send a physical letter through the postal service, the envelope is stamped by every sorting facility and post office it passes through before reaching the destination. An email header works in the exact same way.

The header is a block of hidden metadata attached to the top of an email. As the email travels across the internet, every server that handles it adds a digital “stamp” (a Received: line) detailing exactly who sent it, what time it was received, and the IP address of the server. While a scammer can easily forge the “From:” name (e.g., changing the display name to “Apple Support”), they cannot forge the server stamps embedded in the header.

Step 1: Extracting the Raw Header

Email clients deliberately hide this metadata because it looks like a wall of confusing code. You must instruct your client to reveal it.

In Gmail

1. Open the suspicious email.
2. Click the three vertical dots (More menu) in the top right corner of the email, next to the Reply button.
3. Select Show original.
4. A new tab will open displaying a summary, followed by a massive block of raw text. Click the Copy to clipboard button.

In Outlook (Web)

1. Open the suspicious email.
2. Click the three horizontal dots (More actions) on the right side of the email.
3. Hover over View, and select View message details.
4. A popup will appear with the raw code. Copy all the text.

In Apple Mail (Mac)

1. Open the suspicious email.
2. In the top menu bar, click View > Message > All Headers.
3. The metadata will appear at the top of the email body. Copy the text.

Step 2: Analysing the Data

While you can read the raw text manually, it is incredibly tedious. Cybersecurity professionals use automated tools to parse the data into a readable format.

1. Open a new browser tab and navigate to Google’s official analysis tool: Google Admin Toolbox Messageheader (https://toolbox.googleapps.com/apps/messageheader/).
2. Paste your copied header text into the large blank box.
3. Click Analyze the header above.

The tool will instantly parse the chaotic text into clear, distinct fields. You must now investigate two critical areas.

Clue 1: Tracing the “Received:” Chain

Look at the section detailing the delivery hops. The journey is read from bottom to top (the bottom is where the email originated, and the top is your inbox).

Look specifically at the very first hop at the bottom. This exposes the true IP address and server name of the sender.

• If the email claims to be from [email protected], but the originating server hop reveals it was dispatched from a server named host.cheap-vps-russia.net, you have definitively proven the email is a malicious forgery.
• Legitimate enterprise companies route their emails through their own dedicated infrastructure (e.g., outbound.paypal.com) or massive authenticated providers like Amazon SES or Microsoft 365.

Clue 2: Verifying the Authentication Results (SPF and DKIM)

The most powerful weapons against phishing are SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). These are cryptographic protocols that prove the sender is legally authorized to send emails on behalf of a domain.

Scroll to the Authentication-Results section in the analysis tool.

• SPF Check: This checks if the IP address that sent the email is listed on the official DNS records of the domain. If an attacker spoofs the “From:” address to look like [email protected], but sends it from their own server, the SPF check will display a hard FAIL.
• DKIM Check: This verifies a cryptographic signature hidden in the email to ensure the message was not altered in transit. If the email is forged, the DKIM will be listed as FAIL or completely missing.

If an email claims to be from a major financial institution or technology company, but the SPF and DKIM results are failing, it is an absolute certainty that the email is a phishing attempt designed to steal your credentials.

Trusting the graphical presentation of an email is a dangerous gamble in the modern threat landscape. By taking a few extra seconds to extract the metadata and learning how to identify a malicious phishing email by analysing email headers, you strip away the cybercriminal’s disguise, revealing the true origin of the message and protecting your digital identity from compromise.