2.3.2. Email Analysis Techniques
💡 First Principle: Email is the most common initial access vector because it bypasses network controls by design — the security controls for email work at the content and authentication layer, not at the network layer.
Phishing succeeds not because email security is absent, but because attackers are skilled at crafting messages that appear legitimate. Analyst-level email analysis means going beyond "does this look suspicious?" to examining the technical evidence in headers and authentication records.
Email Header Analysis
Every email carries a header containing the routing history, authentication results, and metadata. Key fields:
| Header Field | What It Shows | Red Flags |
|---|---|---|
From: | Display name (user-visible) | Can be anything — easily spoofed |
Reply-To: | Where replies go | Different from From: = suspicious |
Return-Path: | Bounce address | Different from claimed sender domain |
Received: chain | Every server that relayed the email | Unexpected routing through unfamiliar countries |
X-Originating-IP: | Sending IP address | Check against SPF, geolocation |
Authentication-Results: | SPF/DKIM/DMARC outcomes | Fails = authentication mismatch |
SPF (Sender Policy Framework) — A DNS record listing IP addresses authorized to send email for a domain. When a receiving mail server checks SPF, it verifies the sending server's IP is in the domain's SPF record. A pass means the IP is authorized; a fail means it isn't.
DKIM (DomainKeys Identified Mail) — A cryptographic signature added to outgoing emails by the sending mail server, verifiable via a public key in the domain's DNS. DKIM proves the email content hasn't been tampered with in transit and that the signing domain authorized the message.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) — Builds on SPF and DKIM to tell receiving servers what to do when email fails authentication: none (monitor only), quarantine (spam folder), or reject (block). DMARC also provides reporting — organizations receive reports of emails sent claiming their domain.
⚠️ Exam Trap: A passing SPF check does NOT guarantee a legitimate email. Attackers register lookalike domains (paypa1.com, company-security-alert.com) and configure valid SPF, DKIM, and DMARC records for those domains. The email passes authentication — but it's still phishing. Authentication confirms the email came from where it claims; it cannot confirm whether that claimed identity is trustworthy.
Reflection Question: An analyst reviews an email flagged as phishing. The Authentication-Results header shows spf=pass, dkim=pass, and dmarc=pass. A junior analyst says the email is legitimate because all checks passed. What critical analysis step did the junior analyst skip, and why can a phishing email pass all three authentication checks?
