A message that looks internal
The display name is a colleague. That is the cheapest part of a message to forge. The header is where the mail system recorded the path and the checks it ran.
Leave the body closed
Do not follow a link or open an attachment to see if the message is real. The question you can answer from the header is who handed it to your mail system, and whether the authentication checks passed for a domain that matches the From address.
Tell the user you are reading the header, not the offer. A reply that says "is this you?" goes to the address in the message, which may be the wrong place to ask.
Received, from the bottom
Each Received line is one hop. Read them from the bottom, toward the top. The first hop your organization accepted is the one that answers "where did this enter."
A display name and a Reply-To can disagree with that path. Write the hop. The name in the preview pane is not the hop.
Three results, not one badge
SPF is about the server that sent the envelope. DKIM is a signature over parts of the message. DMARC passes only when SPF or DKIM passes for a domain that lines up with the visible From address.
A pass does not prove a person you trust typed the words. A fail is a reason to treat the message as untrusted. It is not a reason to experiment with what the message contains.
After this one message
If the domain is yours, an aggregate DMARC report says who else has been sending with it. If the domain only resembles yours, that is a lookalike question, separate from this header.
The labs keep both in the browser: three headers, a set of lookalike names, and one report. Use them before you write a rule for the whole company.
Open next
- 01Reading raw email headers: tracing the Received chain hop by hopLesson
- 02Interpreting Authentication-Results: spf, dkim, dmarc, and compauthLesson
- 03SPF, DKIM, and DMARC: reading records and moving to enforcementLesson
- 04Email securityWorkbench
- 05Phishing header analyzerLab
- 06Lookalike domain triageLab
- 07DMARC aggregate report readerLab