<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-phishing-email-headers
description: >-
  Parse and analyze email headers to identify phishing indicators including
  authentication failures (SPF/DKIM/DMARC), originating IP analysis, relay
  chain anomalies, display name spoofing, and header forgery techniques.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - email-headers
  - spf
  - dkim
  - dmarc
  - email-forensics
  - phishing-analysis
  - message-trace
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001"]
---

# Analyzing Phishing Email Headers

## Overview

Email headers contain the forensic evidence needed to trace a phishing message
back to its origin. This skill covers parsing Received chains, evaluating
authentication results (SPF, DKIM, DMARC, ARC), identifying relay anomalies,
and extracting IOCs from raw headers. Proper header analysis is the first step
in any phishing investigation and feeds directly into incident response workflows.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `email` stdlib | Built-in Python email parsing |
| `dig` / `nslookup` | DNS record verification |
| `whois` | IP and domain ownership lookup |
| `mha` (Message Header Analyzer) | `pip install mail-header-analyzer` |

## Key Concepts

### Header Parsing Order

Email headers are read **bottom-to-top** — the bottom-most `Received:` header
is the originating server, each subsequent header is an upstream relay:

```
Received: by final-mta.company.com    ← Last hop (your mail server)
Received: from relay.example.com      ← Intermediate relay
Received: from origin.attacker.com    ← Originating server (bottom)
```

### Authentication-Results Header

```
Authentication-Results: mx.company.com;
  spf=fail (sender IP is 192.168.1.100) smtp.mailfrom=attacker@spoofed.com;
  dkim=fail (signature verification failed);
  dmarc=fail (p=REJECT) header.from=spoofed.com;
  compauth=fail reason=000
```

### Critical Header Fields

| Header | Phishing Indicator |
|---|---|
| `From` | Display name spoofing, domain mismatch |
| `Reply-To` | Different domain than `From` (BEC indicator) |
| `Return-Path` | Envelope sender mismatch |
| `Received` | Suspicious originating IP, unexpected relay |
| `X-Originating-IP` | Attacker infrastructure IP |
| `Message-ID` | Domain in Message-ID mismatches From domain |
| `X-Mailer` | Unusual or known-malicious mail client |
| `Authentication-Results` | SPF/DKIM/DMARC failures |

### Common Spoofing Techniques

```
1. Display Name Spoofing
   From: "CEO Name" <attacker@evil.com>

2. Cousin Domain
   From: admin@c0mpany.com (zero instead of 'o')

3. Reply-To Redirect
   From: ceo@company.com
   Reply-To: ceo.company@gmail.com

4. Header Injection
   Injecting extra headers via SMTP vulnerabilities

5. ARC Seal Bypass
   Forging ARC headers to override DMARC failures
```

## Workflow

### 1. Extract Raw Headers

```bash
# Outlook: Open message → File → Properties → Internet Headers
# Gmail: Open message → three dots → Show original
# M365 Admin: Message trace → export headers

# Save headers to file for analysis
cat > /tmp/phish_headers.txt << 'EOF'
<paste raw headers here>
EOF
```

### 2. Parse Authentication Results

```bash
# Check SPF alignment
dig TXT $(echo "sender@domain.com" | cut -d@ -f2) | grep spf

# Verify DKIM selector
dig TXT selector._domainkey.domain.com

# Check DMARC policy
dig TXT _dmarc.domain.com

# Lookup originating IP reputation
whois 192.168.1.100
dig -x 192.168.1.100
```

### 3. Analyze Received Chain

```bash
# Extract all Received headers (bottom-to-top)
grep -i "^Received:" /tmp/phish_headers.txt

# Extract IPs from Received chain
grep -oP '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}' /tmp/phish_headers.txt | sort -u

# Check each IP against threat intelligence
# Use agent.js for automated analysis
node agent.js parse /tmp/phish_headers.txt
node agent.js extract-iocs /tmp/phish_headers.txt
```

### 4. Timeline Reconstruction

```bash
# Extract timestamps from Received headers to build delivery timeline
# Look for time gaps indicating delayed delivery or relay manipulation
node agent.js timeline /tmp/phish_headers.txt
```

## Detection

```yaml
title: Phishing Email Headers Detection
id: db286bbf-4157-4b6c-bbbc-547d26d850b8
status: experimental
description: Detects suspicious activity related to analyzing phishing email headers techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566.001
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| SPF result extracted | `Authentication-Results` contains `spf=` |
| DKIM result extracted | `Authentication-Results` contains `dkim=` |
| DMARC result extracted | `Authentication-Results` contains `dmarc=` |
| Originating IP identified | Bottom `Received:` header IP parsed |
| IOCs extracted | IPs, domains, URLs collected from headers |
| Relay chain validated | No unexpected hops or time anomalies |

## References

- [RFC 5322 — Internet Message Format](https://datatracker.ietf.org/doc/html/rfc5322)
- [RFC 7208 — SPF](https://datatracker.ietf.org/doc/html/rfc7208)
- [RFC 6376 — DKIM](https://datatracker.ietf.org/doc/html/rfc6376)
- [RFC 7489 — DMARC](https://datatracker.ietf.org/doc/html/rfc7489)
- [Microsoft Message Header Analyzer](https://mha.azurewebsites.net/)
- [Google Admin Toolbox](https://toolbox.googleapps.com/apps/messageheader/)
