Should I open the attachment or click links to investigate?

No. Review headers first and do not open attachments or follow links from a message you suspect. Report it through your organization's process.

What should I do if headers look fine but the message still feels wrong?

Trust the doubt. A message can authenticate for a domain the attacker owns. Verify any request through a known channel and report it.

How do I report a suspicious email?

Use your organization's reporting process or your mail provider's report phishing option, and keep the original message and headers as evidence.

Security

Published October 9, 20263 min read

How to Investigate Suspicious Emails Using Headers

A calm, step-by-step workflow for reviewing a suspicious message's headers.

When a message seems off, headers can give you facts to work from instead of a gut feeling. This workflow is a way to gather evidence safely and calmly. It will not give you a definitive yes or no, but it helps you decide what to do next.

1. Do not interact with the message

Do not click links, open attachments or reply. Copy the full original headers from the mail client's Show original, View source or Message headers option. Only investigate messages you are authorized to inspect.

2. Check the authentication results

Paste the headers into the Email Header Analyzer and look at the SPF, DKIM and DMARC results reported by the receiving server. A DMARC fail or no results at all deserves extra caution; passes show that a domain authorized the message but not that the content is trustworthy.

3. Compare who the message claims to be from

Does the From domain match the organization the message claims to represent?
Does the Reply-To send answers somewhere unrelated?
Does the display name hold an address that differs from the real one?
Does the Return-Path or DKIM domain make sense for that sender?

4. Read the route

Read the Received headers bottom to top. Private addresses are normal in internal hops, and odd hostnames are common for hosted mail. Look for timestamps that run backward, malformed lines or an origin that has nothing to do with the claimed sender.

5. Weigh everything together

Evidence	Weight
DMARC fail for the From domain	Strong technical signal
Multiple From headers	Strong technical signal
Reply-To to another domain	Context, review it
Different Return-Path domain	Often normal for bulk senders
Private IPs, odd HELO names	Usually normal

6. Decide and record

If the message asks for money, credentials or urgency, verify through a channel you already trust. Report it through your organization's process and keep the original headers as evidence. If you need to share the headers with a colleague or a ticket, mask addresses and IPs first using the Log Sanitizer.

Headers cannot settle it

Email headers can provide useful authentication and routing information, but they cannot by themselves prove that a message is safe or malicious. They are one input alongside the message content and its context.

If the message links to a website, the HTTP Security Headers Analyzer and CSP Analyzer are for your own sites rather than for judging someone else's, so use dedicated link-scanning guidance from your security team for URLs.

Frequently asked questions

Should I open the attachment or click links to investigate?: No. Review headers first and do not open attachments or follow links from a message you suspect. Report it through your organization's process.
What should I do if headers look fine but the message still feels wrong?: Trust the doubt. A message can authenticate for a domain the attacker owns. Verify any request through a known channel and report it.
How do I report a suspicious email?: Use your organization's reporting process or your mail provider's report phishing option, and keep the original message and headers as evidence.

#email #phishing #incident-response #email-headers #security