Read the headers and decide whether the sender is real

short · 35 min · Objective 2.2

Task

Construct two email messages — one that authenticates correctly and one that does not — and learn to read the header fields that settle whether a message really came from the domain it claims.

Steps

  1. Write /tmp/good.eml: a plain message with Return-Path, From, Received and an Authentication-Results header showing spf=pass dkim=pass dmarc=pass with the domain in header.from matching the SPF domain.
  2. Write /tmp/spoof.eml: the same message, but with a From display name of a real-looking colleague, a From address at a lookalike domain, and Authentication-Results showing spf=pass for the LOOKALIKE domain with dmarc=fail for the displayed one.
  3. Write /tmp/parse.sh: a script that takes an .eml file and prints the From domain, the Return-Path domain, and each of the spf, dkim and dmarc results.
  4. Run it against both files and note which single field distinguishes them.
  5. Add to the script a verdict line: it must print SUSPECT when dmarc does not pass or when the From and Return-Path domains differ.
  6. Record in /tmp/headers.md why spf=pass alone is not evidence the message is from who it appears to be from.

Verify

bash /tmp/parse.sh /tmp/good.eml | grep -ci "suspect"
bash /tmp/parse.sh /tmp/spoof.eml | grep -ci "suspect"
grep -icE "envelope|return-path|alignment|header.from" /tmp/headers.md

The first must be 0 and the second must be at least 1 — the script passes the legitimate message and flags the spoof. A script that flags both is not discriminating, and one that flags neither has not implemented the verdict. The third confirms you wrote down the reason: SPF validates the envelope sender, and only DMARC requires alignment with the From: address the recipient actually sees.

Notes

This is the single most useful five minutes of analysis in a phishing triage, and it is why the Domain 4 lesson makes so much of DMARC alignment. A message can pass SPF perfectly and still be from an attacker, because it passed for their domain.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.