Check an email header for spoofing HEADERPROOF

Why the From line is worth nothing

The address you see in your mail client is text the sender typed. There is no step anywhere in delivery that checks it against who actually connected, which is why a convincing forgery is not a technical achievement; it is a form field.

What can be checked is the envelope underneath it, and that is what the three authentication results are about.

• SPF asks whether the server that connected is one the sending domain publishes as allowed to send for it. It checks the envelope sender, which is often a different domain from the one in the From line, so SPF can pass on a message that is pretending to be from your bank.
• DKIM is a signature over parts of the message, verifiable against a key in the signing domain's DNS. It proves that domain signed it and that the signed parts were not altered in transit. It does not prove the signing domain is the one in the From line.
• DMARC is the one that closes the gap: it requires that a passing SPF or DKIM result aligns with the domain a reader sees. A DMARC pass is therefore the result worth caring about, and the other two are its working.

Reading the result honestly

A pass is not a safety certificate. It means the message really did come from the domain it claims. Attackers register domains and configure them correctly: micros0ft-billing.com can pass all three perfectly. Check what the domain is, not just whether it authenticated; HOMOGLYPH exists because that reading is harder than it looks.

A fail is not proof of forgery. Mailing lists, forwarding rules and some marketing platforms break SPF and DKIM routinely and innocently. A fail means "this did not authenticate", which is a reason to look harder rather than a verdict.

The Received chain is read from the bottom up: the oldest hop is at the bottom and each server adds its line on top. Headers above the first server you trust can be invented by the sender, so the useful part of the chain begins at your own provider and goes down only as far as the first machine you have a reason to believe.

Getting the headers out

Gmail: open the message, the three-dot menu, Show original. Outlook: File, Properties, Internet headers. Apple Mail: View, Message, All Headers. Paste everything from the top down to the blank line before the body.

Nothing you paste leaves the tab, which matters more than usual here: a raw header block contains your own address, your provider, your internal server names and often the message-ID of an internal thread. PHISHLENS takes the whole message rather than the headers alone, and telling whether an email is genuine walks through a real one.