analyzing-email-headers-for-phishing-investigation

name	analyzing-email-headers-for-phishing-investigation
description	Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing. Use when triaging a suspicious or reported email, investigating a phishing incident, or verifying whether a message's sender domain was spoofed.
domain	cybersecurity
subdomain	digital-forensics
tags	["forensics","email-analysis","phishing","spf","dkim","dmarc","header-analysis"]
version	1.0
author	mahipal
license	Apache-2.0
atlas_techniques	["AML.T0052"]
nist_csf	["RS.AN-03","DE.AE-02","RS.MA-01"]
mitre_attack	["T1566.001","T1566.002","T1598.003"]
mitre_f3	{"version":"1.1","tactics":["reconnaissance","initial-access","stealth","resource-development"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"}]}

Analyzing Email Headers for Phishing Investigation

When to Use

• When investigating a suspected phishing email to determine its true origin
• For verifying sender authenticity and detecting email spoofing
• During incident response when a user has clicked a phishing link
• When tracing the delivery path and relay servers of a suspicious email
• For validating SPF, DKIM, and DMARC alignment to identify forgery

Prerequisites

• Raw email headers from the suspicious message (EML or MSG format)
• Understanding of SMTP protocol and email header fields
• Access to DNS lookup tools (dig, nslookup) for SPF/DKIM/DMARC verification
• Email header analysis tools (MHA, emailheaders.net concepts)
• Python with email parsing libraries for automated analysis
• Access to threat intelligence platforms for IP/domain reputation

Workflow

Step 1: Extract Raw Email Headers

# Export from Outlook: Open email > File > Properties > Internet Headers
# Export from Gmail: Open email > Three dots > Show original
# Export from Thunderbird: View > Message Source

# If working with EML file from forensic image
cp /mnt/evidence/Users/suspect/AppData/Local/Microsoft/Outlook/phishing_email.eml \
   /cases/case-2024-001/email/

# If working with PST file, extract individual messages
pip install pypff
python3 << 'PYEOF'
import pypff

pst = pypff.file()
pst.open("/cases/case-2024-001/email/outlook.pst")
root = pst.get_root_folder()

def extract_messages(folder, path=""):
    for i in range(folder.get_number_of_sub_messages()):
        msg = folder.get_sub_message(i)
        headers = msg.get_transport_headers()
        subject = msg.get_subject()
        if headers:
            filename = f"/cases/case-2024-001/email/msg_{i}_{subject[:30]}.txt"
            with open(filename, 'w') as f:
                f.write(headers)
    for i in range(folder.get_number_of_sub_folders()):
        extract_messages(folder.get_sub_folder(i))

extract_messages(root)
PYEOF

Step 2: Parse the Email Header Chain

python3 << 
import email
from email import policy

with open(, ) as f:
    msg = email.message_from_file(f, policy=policy.default)

()
(f)
(f)
(f)
(f)
(f)
(f)
(f)
(f)
(f)

()
received_headers = msg.get_all()
 received_headers:
     i, header  enumerate(reversed(received_headers)):
        (f)

()
auth_results = msg.get_all()
 auth_results:
     result  auth_results:
        (result)

(f)
(f)
(f)
PYEOF