Email headers reveal the true origin and path of a message, crucial for investigating phishing and spam.
Key headers
- From/Reply-To: Sender addresses (can be spoofed).
- Received: Each mail server that handled the message.
- Return-Path: Where bounces should go.
- Authentication-Results: SPF, DKIM, DMARC verification outcomes.
- X-Originating-IP: Sender's IP address (if available).
Phishing detection
- Check Received headers for suspicious origins.
- Verify SPF/DKIM/DMARC authentication passed.
- Compare From address with Return-Path for mismatches.
- Look for forged Received headers (inspect timestamps).
Related Articles
View all articlesCheck Point Harmony vs Proofpoint: Choosing Email Security for Google Workspace
Compare legacy Secure Email Gateways (SEG) like Proofpoint with modern API-based email security solutions like Check Point Harmony for Google Workspace environments. Learn why architecture matters for cloud email protection.
Read article →Data Breach Response & Notification Workflow | GDPR & HIPAA
Master the complete data breach response workflow from detection to recovery. This comprehensive guide covers GDPR 72-hour notification, HIPAA breach reporting, forensic investigation, regulatory compliance, and customer notification strategies with practical tools and legal frameworks.
Read article →DNS Lookup & Email Security Check
Check DNS records, SPF, DKIM, DMARC, and email security configuration for your domain
Read article →DNS Lookup & Email Security Check
Check DNS records, SPF, DKIM, DMARC, and email security configuration for your domain
Read article →Explore More Email Security
View all termsDKIM (DomainKeys Identified Mail)
Email authentication method that uses cryptographic signatures to verify that email content has not been tampered with in transit.
Read more →DMARC (Domain-based Message Authentication, Reporting, and Conformance)
Email validation system that builds on SPF and DKIM to prevent email spoofing and provide reporting on email authentication failures.
Read more →Email Authentication
A set of protocols (SPF, DKIM, DMARC) that verify the sender of an email is who they claim to be, preventing spoofing and phishing.
Read more →Integrated Cloud Email Security (ICES)
API-based email security solutions that integrate directly with cloud email platforms like Google Workspace and Microsoft 365, rather than routing mail through an external gateway.
Read more →Secure Email Gateway (SEG)
A security solution that filters incoming and outgoing email traffic to protect against spam, phishing, malware, and data loss.
Read more →SPF (Sender Policy Framework)
Email authentication method that specifies which mail servers are authorized to send email on behalf of your domain.
Read more →