How to read email headers to spot phishing
Where to find full email headers in Outlook, Gmail and Microsoft 365, how to read Received lines, SPF, DKIM, DMARC and compauth results, and the red flags of spoofing and business email compromise.
The body of a phishing email is designed to fool people. The headers are much harder to fake, because the receiving mail servers write most of them. Five minutes with the headers usually settles whether a message is spoofed.
Get the full headers
| Client | Where |
|---|---|
| Outlook (classic, Windows) | Open the message > File > Properties > Internet headers |
| Outlook (new / web) | Open the message > ⋯ > View > View message source (or message details) |
| Gmail | ⋮ next to Reply > Show original |
| Microsoft Defender | Explorer or the email entity page > Email headers |
| Reported phish as .eml | The headers are at the top of the file; open it in a text editor |
Read the Received lines from the bottom up
Every server that handles the message adds a Received: line at the top. So the bottom Received line is the oldest hop, closest to the sender, and the top one is your own server.
Received: from mail.badsender.top (91.215.85.142) by AM9PR02MB7012.mail.protection.outlook.com ...
Received: from DESKTOP-7H2K (unknown [45.88.97.11]) by mail.badsender.top (Postfix) ...- In
from X (Y [IP]), X is the name the sender claimed and is easily forged. The IP in brackets is what the receiving server actually saw on the connection. Trust that one. - The first public IP in the chain is usually the true origin. Lines below your organisation's first server can be forged by the sender, so treat them as hints.
- Large gaps between hop timestamps or times going backwards suggest forged lines or a queued spam run.
Authentication results
Your receiving server records its verdicts in Authentication-Results (and Microsoft adds compauth):
Authentication-Results: spf=fail (sender IP is 91.215.85.142) smtp.mailfrom=badsender.top;
dkim=none (message not signed) header.d=none; dmarc=fail action=quarantine header.from=contoso-finance.com; compauth=fail reason=000| Check | What it proves | Pitfall |
|---|---|---|
| SPF | The sending IP is allowed by the envelope domain (Return-Path) | Checks the hidden envelope domain, not the From address you see |
| DKIM | The message was signed by domain d= and not changed since | Any domain can sign; what matters is which domain |
| DMARC | SPF or DKIM passed and lined up with the visible From domain | dmarc=pass is the result that actually protects the From address |
| compauth | Microsoft's combined verdict, including implicit authentication | fail means Microsoft thinks the From domain is spoofed |
Rule of thumb: dmarc=fail on a domain you recognise is the strongest single spoofing signal. dmarc=pass only proves the domain is real, not that it is the company you think it is: check for lookalike domains such as rnicrosoft.com or contoso-finance.com.
Sender fields and BEC red flags
- Reply-To differs from From: replies go to the attacker. The classic business email compromise setup, especially with invoice or payment requests.
- Display name tricks:
"Microsoft 365 Billing" <[email protected]>, or a display name that contains a different email address. - Return-Path on an unrelated domain without DMARC pass.
- Message-ID created by a server unrelated to the claimed sender.
- X-Mailer values like
PHPMaileror scripts in mail that claims to be from a large company. - Spam verdicts:
X-MS-Exchange-Organization-SCLof 5 or more, orSFV:SPMinX-Forefront-Antispam-Report.
A five-minute triage checklist
- Get the full headers or the .eml.
- Read DMARC and compauth first. Fail on a known brand: treat as phishing.
- Compare From, Reply-To and Return-Path domains.
- Find the originating IP (first public IP in the brackets) and check its reputation.
- Look at the links' real destinations and any attachment hashes, never by clicking.
- If it is phishing: purge similar messages from all mailboxes, block the sender domain and IPs, and check whether anyone clicked or replied.
Paste headers or drop an .eml file: authentication results, delivery path, origin IP and BEC red flags with a verdict. Nothing leaves your browser.