HackBlue

Labs / Email and phishing

Phishing header analyzer

Parse three real-shaped message headers, follow the Received hops, and work out why SPF, DKIM, and DMARC pass or fail for each one.

  • Interactive lab
  • Beginner
  • 5 steps
  • 0 of 5 solved

Goal

Three messages reached the Contoso mailbox. Pick each one, read its raw headers, and use the parsed view to follow the Received chain and the authentication results.

DMARC passes only when SPF or DKIM passes for a domain that aligns with the From address. Turn on the alignment check once you have a guess.

Message

Analysis

Raw headers10 fields
Authentication-Results: mx1.contoso.example;
       spf=pass (sender IP is 198.51.100.40) smtp.mailfrom=bounces.esp-mail.example;
       dkim=pass (signature was verified) header.d=fabrikam.example;
       dmarc=pass action=none header.from=fabrikam.example
Received: from mta-40.esp-mail.example (mta-40.esp-mail.example [198.51.100.40])
       by mx1.contoso.example with ESMTPS id 7Hq2aa for <ana@contoso.example>;
       Fri, 13 Mar 2026 15:02:44 +0000
Received: from app-02.fabrikam.example (app-02.fabrikam.example [10.40.0.12])
       by mta-40.esp-mail.example with ESMTP id 9Kd1;
       Fri, 13 Mar 2026 15:02:41 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=fabrikam.example; s=esp1; h=from:to:subject:date;
       bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=; b=dGhpcyBpcyBhIGxhYiBzaWduYXR1cmU=
Return-Path: <bounce-8821@bounces.esp-mail.example>
From: Fabrikam Freight <news@fabrikam.example>
To: ana@contoso.example
Subject: March shipping schedule
Date: Fri, 13 Mar 2026 15:02:40 +0000
Message-ID: <n-20260313-8821@fabrikam.example>

Addresses

From
Fabrikam Freight <news@fabrikam.example>
Reply-To
(not set)
Return-Path
<bounce-8821@bounces.esp-mail.example>

Received hops, first to last

  1. 1
    app-02.fabrikam.example 10.40.0.12 → mta-40.esp-mail.exampleFri, 13 Mar 2026 15:02:41 +0000
  2. 2
    mta-40.esp-mail.example 198.51.100.40 → mx1.contoso.exampleFri, 13 Mar 2026 15:02:44 +0000

Authentication

CheckResultDomain
SPFpassbounces.esp-mail.example
DKIMpassfabrikam.example
DMARCpassfabrikam.example

Steps

  1. 01Which message fails DMARC?

  2. 02The newsletter passes DMARC through which mechanism?

  3. 03What public IP address did the payroll message start from?

  4. 04Replies to the payroll message would go to which domain?

  5. 05Why does the forwarded catalogue still pass DMARC when SPF fails?