Lesson 2.4: Reading e-mail headers
The From line is just text the sender typed. The headers underneath tell the real story: where the message came from (Received), where replies go (Reply-To), where bounces go (Return-Path), and whether the receiving server could verify the sender's domain with SPF, DKIM and DMARC. In the lab you analyse the 'password expires today' message Elif reported, compare it with a genuine company newsletter, and check the company's own SPF and DMARC records with dig to see exactly why it failed.
17 min
You will learn to
- Explain why the From line can be forged
- Read Received, Reply-To and Return-Path
- Explain SPF, DKIM and DMARC
- Read Authentication-Results
- Check a domain's SPF and DMARC with dig
Key terms
- Header
- Lines at the top of an e-mail that describe it: sender, recipients, route, authentication results.
- Received
- A line each mail server adds when it accepts the message, newest first.
- Reply-To and Return-Path
- Where replies go, and where bounce messages go (the envelope sender).
- SPF
- Sender Policy Framework: a DNS TXT record listing the servers allowed to send mail for a domain.
- DKIM
- DomainKeys Identified Mail: a digital signature added by the sending domain and checked with a public key in DNS.
- DMARC
- A DNS policy that ties SPF/DKIM to the visible From domain and tells receivers what to do with failures (none, quarantine, reject).
← Introduction to the command line · All lessons · MAC addresses, Ethernet and ARP →