Read the headers and decide whether the sender is real

short · 35 min · Objective 2.5

Task

Construct two email messages -- one that authenticates correctly and one that impersonates a colleague -- and learn to read the header fields that settle whether a message really came from the domain it claims. Display-name mismatches and lookalike domains are the indicators the lesson names; the headers are where you prove them.

Steps

  1. Write /tmp/good.eml: a plain message with Return-Path, From, Received and an Authentication-Results header showing spf=pass dkim=pass dmarc=pass with the domain in header.from matching the SPF domain, and the Return-Path at that same domain -- step 5 flags a mismatch, so the good message must not have one.
  2. Write /tmp/spoof.eml: the same message, but with a From display name of a real-looking colleague, a From address at a lookalike domain, and Authentication-Results showing spf=pass for the LOOKALIKE domain with dmarc=fail for the displayed one.
  3. Write /tmp/parse.sh: a script that takes an .eml file and prints the From domain, the Return-Path domain, and each of the spf, dkim and dmarc results.
  4. Run it against both files and note which single field distinguishes them.
  5. Add to the script a verdict line: it must print SUSPECT when dmarc does not pass or when the From and Return-Path domains differ.
  6. Record in /tmp/headers.md why spf=pass alone is not evidence the message is from who it appears to be from, and what a recipient on a phone -- who sees only the display name -- would have seen.

Verify

bash /tmp/parse.sh /tmp/good.eml | grep -ci "suspect"
bash /tmp/parse.sh /tmp/spoof.eml | grep -ci "suspect"
grep -icE "envelope|return-path|alignment|header.from" /tmp/headers.md

The first must be 0 and the second must be at least 1 -- the script passes the legitimate message and flags the spoof. A script that flags both is not discriminating, and one that flags neither has not implemented the verdict. The third confirms you wrote down the reason: SPF validates the envelope sender, and only DMARC requires alignment with the From: address the recipient actually sees.

Notes

This is the single most useful five minutes of analysis in a phishing triage. A message can pass SPF perfectly and still be from an attacker, because it passed for their domain. Business email compromise from a genuinely compromised mailbox passes everything, which is why the lesson's answer to it is out-of-band verification of payment changes rather than any header check.

This is an independent study companion for CompTIA Security+ SY0-801 and is not produced by or endorsed by CompTIA.