Learning how to analyze phishing email headers and links can help you decide whether a message is trustworthy without replying, clicking, or forwarding it carelessly. This reusable workflow shows how to inspect the sender, review SPF, DKIM, and DMARC results, examine links safely, preserve evidence, and escalate a suspicious email to an IT or security team.
Overview
A suspicious email can look convincing even when its visible sender name, logo, or writing style appears familiar. The practical question is not simply “Does this look real?” but “What technical evidence supports the sender’s identity, and where would this link actually lead?”
Email headers contain delivery and authentication details that are usually hidden in the normal inbox view. They may show the domains involved in sending the message, the servers that handled it, and the results of checks such as SPF, DKIM, and DMARC. These results are useful signals, but they are not a complete verdict. A well-configured legitimate domain can still send a malicious message through a compromised account, while a failed authentication check can sometimes result from forwarding or configuration problems.
Use this process when an email requests a password, payment, sensitive document, account recovery action, gift card purchase, wire transfer, or urgent change to business information. If the message concerns a financial account or an existing incident, avoid interacting with it until you have verified the request through a trusted channel.
Checklist by scenario
1. Before opening or interacting with the message
- Do not click links, open unexpected attachments, reply, or call a phone number included in the email.
- Record the visible sender name, displayed address, subject, date, and the action requested.
- Ask whether the request is expected and whether it creates pressure, secrecy, or an unusual payment or login demand.
- If the message appears to come from a colleague, vendor, bank, marketplace, or service, contact that party through a known website, saved number, or established internal channel.
2. View the complete headers
Email applications use different labels, but the option is commonly called Show original, View source, View message details, or View headers. Do not rely on the short “From” line alone. If your organization uses a mail gateway, preserve the original message or export it in the format your security team requests rather than copying only the visible text.
Look for these fields and sections:
- From: the address displayed to the recipient. It can be spoofed or made to resemble a trusted address.
- Reply-To: the address that may receive a reply. A mismatch with the From address deserves scrutiny.
- Return-Path: the address used for delivery handling and bounce messages. It may differ from the visible sender for legitimate reasons, but an unexpected domain is a useful warning signal.
- Received: a series of delivery records. Read them as a chain rather than treating the first or last line as definitive proof. Mail systems and forwarding services can add multiple entries.
- Authentication-Results: a summary of checks performed by the receiving system, often including SPF, DKIM, and DMARC.
3. Interpret authentication results
| Result | What it generally indicates | What to do |
|---|---|---|
| SPF pass | The sending server was authorized by the SPF policy for a domain used in the check. | Confirm which domain passed and whether it aligns with the organization the email claims to represent. |
| DKIM pass | A digital signature validated for a domain and the signed message content was not altered in a way that breaks the signature. | Check the signing domain. A pass for a hosting or sending provider is not automatically proof that the person or brand is trustworthy. |
| DMARC pass | The message passed the domain’s DMARC evaluation, including alignment between the visible From domain and an authenticated domain. | Treat it as a stronger identity signal, but still assess the request and destination link. |
| SPF, DKIM, or DMARC fail | The message did not satisfy that particular authentication check. | Pause and escalate. Forwarding, mailing lists, and configuration issues can cause failures, so investigate context rather than assuming the result alone proves fraud. |
| None, unavailable, or unclear | The receiving system may not have performed the check or may not display enough information. | Use other evidence, such as domain alignment, link destinations, and independent verification. |
SPF mainly concerns authorized sending infrastructure. DKIM concerns a message signature. DMARC ties authentication to the visible From domain and applies the sending domain’s policy. None of these checks confirms that the email’s request is safe, that an account has not been compromised, or that a domain owner is reputable.
4. Inspect links without opening them
- On a desktop, hover over the link and read the destination shown by the application. On a mobile device, use the link’s preview or copy option without selecting it.
- Copy the URL into a plain-text editor or a safe analysis environment. Do not paste it into a browser address bar by accident.
- Read the domain from right to left before the first single slash. In
account.example.com.evil.test, the registrable domain isevil.test, notexample.com. - Watch for misspellings, lookalike characters, unexpected subdomains, URL shorteners, punycode, extra redirects, and a domain that does not match the claimed organization.
- Be cautious with links that use HTTPS. Encryption protects the connection to a site; it does not establish that the site itself is legitimate.
Do not submit credentials or personal information to “test” a link. If you need a second opinion, use your organization’s approved email security tools or a reputable URL analysis process that does not expose confidential tokens. For a broader URL review, see How to Check if a Link Is a Scam Before You Click.
5. Preserve and escalate the evidence
Save the original message, complete headers, attachment names, destination URLs, and relevant timestamps. Avoid forwarding the email as a normal message if doing so could remove headers or activate content. Use your company’s phishing-report button, ticketing system, or security mailbox when available.
A concise escalation note can follow this format:
Subject: Suspected phishing email for review
Received: [date, time, and time zone]
Displayed sender: [name and address]
Request: [login, payment, document, or other action]
Authentication summary: [SPF, DKIM, DMARC results and domains]
Link destination: [copied URL, if safe to capture]
Interaction: [not opened, opened, clicked, submitted information, or downloaded attachment]
Attachments: [names and types]
Requested review: Please assess whether this is phishing and advise on containment or follow-up.
What to double-check
- Domain alignment: Compare the visible From domain, DKIM signing domain, SPF result domain, Reply-To domain, and link domain. Differences are not automatically malicious, but unexplained differences require verification.
- Business payment changes: Never approve a new bank account, invoice, payroll detail, or payment instruction solely because it came by email. Use a previously trusted contact method. The business payment change verification playbook covers this scenario.
- Account recovery requests: Navigate to the service using a known bookmark or manually entered address instead of the email link. If you already clicked, follow the post-click account recovery plan.
- Reply-To changes: A reply address controlled by a different domain can indicate impersonation, but some legitimate notification systems use separate addresses. Verify the relationship independently.
- Attachments: A familiar file type can still be dangerous. Do not enable macros, run scripts, or bypass device warnings to view an unexpected document.
- Context: A technically authenticated email can still be a compromised account, a malicious marketing message, or an abuse of a legitimate sending service. Authentication supports identity analysis; it does not replace judgment.
Common mistakes
- Trusting the display name: Names are easy to imitate. Inspect the complete address and relevant domains.
- Treating one failed check as conclusive: Forwarding and mail-routing changes can affect results. Review all available evidence.
- Assuming a pass means safe: A pass may only show that an authorized system sent the message for a domain. It does not validate the request.
- Opening a link to see where it goes: Redirects, tracking URLs, and login pages can expose you to risk before you have reviewed the destination.
- Copying only the email body: Security teams often need the original headers and message file to investigate delivery and authentication details.
- Forwarding widely: Broad forwarding can expose sensitive content and may alter the evidence. Use the approved reporting route.
- Using public analyzers with confidential URLs: Password-reset links, document links, and private tracking tokens may contain sensitive information. Follow organizational policy before submitting them to any external tool.
When to revisit
Keep this checklist available whenever you receive an unusual message, report a phishing email, or investigate a potential business email compromise. Revisit the workflow before seasonal planning cycles and whenever your organization changes email providers, security gateways, reporting buttons, or authentication settings.
Email-client interfaces and provider terminology change over time, so refresh the instructions at least twice a year. Review them sooner when a major provider changes how it displays headers, when SPF, DKIM, or DMARC policies are modified, or when new phishing techniques affect link handling. IT teams should also test the escalation template periodically so staff know where to send the original message and what evidence to include.
For a final action check, ask: Have I avoided interacting with the message, verified the request independently, reviewed the full sender and destination details, preserved the original evidence, and reported it through the correct channel? If any answer is no, pause before proceeding. You can also consult the evidence checklist for reporting a scam and the guide to checking a suspicious sender.
