The visible "From" line of an email is trivially forged. The truth lives in the email header — the hidden metadata recording the servers a message crossed and the authentication checks it passed or failed. Reading it tells you where a message really came from and whether to trust it.
What you'll need
- The full, raw header of the email (your client's "show original" or "view source" option)
- A header-analysis tool from the Phone Numbers & Emails category
- IP and domain lookups from the Domain Names & Usernames category
Steps
- Extract the raw header. Open the message's original source so you can see every field, not just the friendly summary your client shows.
- Read the Received chain bottom-up. The lowest "Received" line is usually the origin; each line above is the next hop. Follow it up to find the first sending server and its IP address.
- Check authentication results. Look at SPF, DKIM, and DMARC. Failures — or a "From" domain that does not match the sending server — are strong signs of spoofing.
- Geolocate and attribute the source IP. Look up the originating IP for its owner and rough location; cross-check the sending domain's WHOIS records.
- Correlate with the content. Weigh the technical origin against the message's claims, links, and attachments to judge whether it is legitimate, spoofed, or phishing.
Common pitfalls
- Trusting the display name. It carries no authority; only the header chain and auth results do.
- Misreading the Received order. Read bottom to top — reversing it points you at your own mail server, not the sender.
- Forgetting relays and services. Mailing lists and marketing platforms add legitimate hops that can look suspicious if misread.
Verify your result
You have traced the email when you can name the originating server and IP, state whether SPF/DKIM/DMARC passed, and explain whether the "From" address is genuine or forged.