Who really sent that email?
The name and address in an email’s From line are typed by whoever sends it, the same way you type the address on an envelope. Anyone can write “Your Bank” there. But every email also carries a hidden record of how it travelled and whether it passed the sending domain’s own checks, and that record is much harder to fake. In this lesson you’ll open it, read it, and compare a real email with a forgery.
In this lesson
- Find an email’s hidden headers in your own mail app
- Read the three checks that show whether a sender is genuine
- Check whether a company’s domain can be faked at all
You’ll need: a computer is easiest, with your email open in a browser or app, and one newsletter or receipt from a company you trust.
The three checks
When an email arrives, the receiving mail server runs three checks on it and writes the results into the headers:
- SPF asks: was the server that sent this allowed to send email for that domain? The domain owner publishes a list of permitted servers.
- DKIM asks: was the message signed with the domain’s own digital key, and is it unchanged since?
- DMARC asks the question that matters most: does the domain that passed SPF or DKIM match the domain in the From line that you see? A scammer can pass SPF and DKIM for their own domain, then type your bank’s name in the From line. DMARC is what catches that.
So the result to read first is DMARC. Pass means the message really came from the domain it shows. Fail means the From line doesn’t match where it came from.
Try it yourself · part 1
Read a real email’s headers
- Open a newsletter or receipt from a company you trust, and copy its full headers. Every mail app hides them; here’s where to find them:
App How to get the headers Gmail (web) Open the message, click the three dots beside Reply, choose Show original, then copy everything in the panel. Outlook (web) Open the message, three dots, View, View message details. Outlook (desktop) Double-click to open the message in its own window, then File, Properties, Internet headers. Apple Mail View, Message, All Headers. Thunderbird View, Message Source. Proton Mail Three dots on the message, View headers. - Paste them into the Email Header Analyzer and click Analyze. It reads them in your browser; the email isn’t uploaded.
- Look at the three boxes, SPF, DKIM and DMARC. For a genuine company you’d expect DMARC to say Pass.
- Look at FROM and RETURN-PATH. Big companies often send newsletters through mailing services, so the return address may be a different domain. That’s normal when DMARC passes.
- Scroll to the list of hops: each one is a mail server the message passed through, oldest first. Under ORIGIN IP, Who owns it? shows whose network it started from.
Try it yourself · part 2
Now look at a forgery
- In the analyzer, click Load a sample, then Analyze. This is a made-up “overdue invoice” email built to show what a forgery looks like.
- The result at the top says FAILED CHECKS: This message did not authenticate.
- Notice that SPF and DKIM both Pass, but DMARC Fails. The message was properly sent and signed, just by a different domain from the one in the From line. That’s exactly the trick DMARC exists to catch.
- Read the warnings underneath. One says replies would go to a different domain from the sender’s. A Reply-To that points somewhere else is a common sign of phishing, though some companies do use a separate support address.
What “Pass” doesn’t prove
A DMARC Pass proves the email came from the domain in the From line. It doesn’t prove that domain is the company you think. A scammer who registers amazon-refund-desk.com can pass all three checks, for their own domain. So after the checks, read the From domain the way you read links in Lesson 2: is it the company’s real domain, or just a name with the brand in it?
Try it yourself · part 3
Can this domain be faked?
Some domains tell receiving servers to reject anything that fails DMARC. Others don’t, so fake emails “from” them can still land in an inbox. You can check any domain:
- Open the DMARC, SPF and DKIM Checker, type a domain, for example the one your bank emails you from, and click Check domain.
- Read the verdict:
- Protected: the domain is hard to spoof; failing mail is meant to be refused.
- Partly protected: some failing mail can still get through, for example because it’s sent to spam rather than refused. The lines under the verdict say why.
- Monitoring only: the owner only collects reports, and failing mail is still delivered.
- Spoofable: no usable DMARC policy at all.
- Try a few you know. Big brands differ more than you’d expect: on the day this lesson was written, paypal.com was Protected, while gmail.com was Monitoring only. A domain that isn’t Protected is one where the DMARC result in each email matters even more.
Key takeaways
- The From name and address are typed by the sender and prove nothing on their own.
- DMARC is the check to read first: Pass means the From domain really sent it.
- SPF and DKIM can pass for a scammer’s own domain; only DMARC ties them to the From line.
- A Pass doesn’t make the domain trustworthy. Check it’s the company’s real one.
- Never forward an email before checking its headers: forwarding replaces them.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. An email from “Your Bank” shows SPF Pass, DKIM Pass and DMARC Fail. What does that mean?
2. Why shouldn’t you forward a suspicious email to yourself before checking its headers?
3. The DMARC checker says a company’s domain is “Monitoring only”. What does that tell you?
Want to know what each result means in depth? The Email Header Analyzer page explains every field, and the DMARC checker page explains each record.
This lesson is part of the free course Scams and Staying Safe, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.