Email
Radiograph: Headers
Who really sent this email
Received: from mail.example.net (203.0.113.10)
Authentication-Results: spf=pass dkim=pass dmarc=pass
DKIM-Signature: v=1; d=example.com; s=sel1; b=Q2hl…
Return-Path: <ana@example.com>
From: Ana <ana@example.com>
Reply-To: ana@example.com
To: tu@example.org
Subject: Tomorrow's meeting
Message-ID: <abc123@example.com>
Route
Received is added by every server. Read it bottom to top.
Authentication
SPF, DKIM and DMARC: pass or fail.
Identity
From is what you see; Return-Path is the real envelope.
Content
Recipient, subject, date and message identifier.
Spoofing signs
- • From different from Return-Path or a Reply-To on another domain
- • dmarc=fail, spf=fail o dkim=fail
- • A Received with an IP that does not belong to the sender
xeland314If the From lies, DMARC exposes it.