analyzing-email-headers-for-phishing-investigation

name	analyzing-email-headers-for-phishing-investigation
description	Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation. Use when working with analyzing email headers for phishing investigation.
domain	cybersecurity
tags	["forensics","email-analysis","phishing","spf","dkim","dmarc","header-analysis"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
atlas_techniques	["AML.T0052"]
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Analyzing Email Headers For Phishing Investigation

Overview

Cybersecurity skill for analyzing email headers for phishing investigation. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing email headers for phishing investigation"

• "Parse and analyze email headers to trace the origin of phishing emails, verify s"

• When investigating a suspected phishing email to determine its true origin

• For verifying sender authenticity and detecting email spoofing

• During incident response when a user has clicked a phishing link

• When tracing the delivery path and relay servers of a suspicious email

• For validating SPF, DKIM, and DMARC alignment to identify forgery

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Raw email headers from the suspicious message (EML or MSG format)
• Understanding of SMTP protocol and email header fields
• Access to DNS lookup tools (dig, nslookup) for SPF/DKIM/DMARC verification
• Email header analysis tools (MHA, emailheaders.net concepts)
• Python with email parsing libraries for automated analysis
• Access to threat intelligence platforms for IP/domain reputation

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}