How to read email headers for spoofing
The visible From address is presentation. Investigation begins by comparing it with Reply-To and Return-Path, reading Received hops from the bottom upward, and reviewing SPF, DKIM and DMARC alignment.
- SPF checks whether an IP is authorized for the envelope-sender domain.
- DKIM verifies a cryptographic signature from a signing domain.
- DMARC evaluates alignment and the domain owner’s policy.
- A pass is useful evidence but does not prove the request itself is honest.
Paste raw headers into the Email Header & BEC Analyzer.