Lab PH.1 — Email Header Dissection

Lab Overview

The Scenario

Your SOC team has received two suspicious email reports from employees. The first came from the finance department — an employee received an "urgent invoice" from what appeared to be a known vendor. The second was flagged by the IT help desk — a password reset notification that didn't match any legitimate service.

Your task is to analyze the raw headers of both emails, trace their delivery paths, evaluate their authentication results, and determine whether each message is legitimate or malicious.

Part 1: Understanding Email Header Structure

Before diving into the tools, you need to understand what you're looking at. Email headers are read bottom-to-top — the oldest Received header (closest to the sender) is at the bottom, and the most recent (your mail server) is at the top.

Key Header Fields

Part 2: Sample Email 1 — The Suspicious Invoice

Copy the entire header block below and paste it into MXToolbox Header Analyzer:

Return-Path: <billing-noreply@acm3-invoicing.com>
Received: from mx-gateway-01.company.com (mx-gateway-01.company.com [10.0.1.50])
    by mail-store-02.company.com (Postfix) with ESMTP id A3F4E2C001
    for <jsmith@company.com>; Wed, 18 Feb 2026 09:14:32 -0500 (EST)
Received: from mail-out-07.acm3-invoicing.com (unknown [91.215.42.118])
    by mx-gateway-01.company.com (Postfix) with ESMTP id 7BD1E1A003
    for <jsmith@company.com>; Wed, 18 Feb 2026 09:14:30 -0500 (EST)
Received: from localhost (unknown [192.168.1.105])
    by mail-out-07.acm3-invoicing.com (Postfix) with ESMTP id 4CF891B002;
    Wed, 18 Feb 2026 15:14:28 +0100 (CET)
Authentication-Results: mx-gateway-01.company.com;
    spf=fail (sender IP is 91.215.42.118) smtp.mailfrom=acm3-invoicing.com;
    dkim=none;
    dmarc=fail action=none header.from=acme-corp.com
From: "ACME Corp Billing" <billing@acme-corp.com>
To: jsmith@company.com
Subject: Invoice #INV-2026-4471 — Payment Due Immediately
Date: Wed, 18 Feb 2026 15:14:28 +0100
Message-ID: <5a8f3c2d-91e7-4b3a-a8d1-3f7e2c1b9a04@acm3-invoicing.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_7823_1098234571.1708265668"
X-Mailer: PHPMailer 6.5.0

Analysis Tasks for Email 1

Work through each question and record your answers:

1. Trace the Received chain (bottom-to-top):

   • What is the originating IP? (Hint: look at the bottom Received header's connecting IP)
   • How many mail servers handled this message?
   • What is the time delay between the first and last hop?

2. Check the From vs Return-Path:

   • The From: header says billing@acme-corp.com
   • The Return-Path: says billing-noreply@acm3-invoicing.com
   • Are these the same domain? What does a mismatch indicate?

3. Evaluate Authentication:

   • SPF result: __________ (pass/fail/none)
   • DKIM result: __________ (pass/fail/none)
   • DMARC result: __________ (pass/fail/none)
   • What does this combination tell you about the sender's legitimacy?

4. Check the X-Mailer:

   • What software sent this email?
   • Is PHPMailer commonly used by legitimate enterprise billing systems?

Click to enlarge

Part 3: Sample Email 2 — The Password Reset

Now paste this second header block into MXToolbox:

Return-Path: <noreply@accounts.google.com>
Received: from mx-gateway-01.company.com (mx-gateway-01.company.com [10.0.1.50])
    by mail-store-02.company.com (Postfix) with ESMTP id B2E4F3D002
    for <jsmith@company.com>; Wed, 18 Feb 2026 11:42:15 -0500 (EST)
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com [209.85.220.41])
    by mx-gateway-01.company.com (Postfix) with ESMTPS id 8AC2E2B001
    for <jsmith@company.com>; Wed, 18 Feb 2026 11:42:14 -0500 (EST)
Authentication-Results: mx-gateway-01.company.com;
    spf=pass (google.com: domain of noreply@accounts.google.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=accounts.google.com;
    dkim=pass header.d=accounts.google.com header.s=20230601 header.b=kX7vPqL2;
    dmarc=pass (p=REJECT sp=REJECT) header.from=accounts.google.com
From: "Google Accounts" <noreply@accounts.google.com>
To: jsmith@company.com
Subject: Security alert for your linked Google Account
Date: Wed, 18 Feb 2026 16:42:13 +0000
Message-ID: <CABx+XJqK2vN8r3w5L1mA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601

Analysis Tasks for Email 2

1. Trace the Received chain:

   • Originating IP: __________
   • Does the IP belong to Google? (Check via MXToolbox IP lookup or WHOIS)
   • How many hops from sender to recipient?

2. From vs Return-Path:

   • Do the domains match?
   • Is the Return-Path consistent with the claimed sender?

3. Evaluate Authentication:

   • SPF: __________
   • DKIM: __________
   • DMARC: __________
   • What is the DMARC policy? What would happen to a failing message?

4. Compare with Email 1:

   • List 3 specific differences between the headers of Email 1 and Email 2
   • Which email would you escalate, and why?

Part 4: MXToolbox Deep-Dive Features

MXToolbox Header Analyzer provides several automated checks beyond basic parsing.

Hop Delay Analysis

The tool calculates the time delay between each Received header hop. Look for:

• Normal: 0–2 seconds per hop
• Suspicious: 10+ seconds per hop (may indicate queuing on a compromised relay)
• Very suspicious: Minutes or hours (message was held for analysis evasion)

Blacklist Check

Click on any IP address in the MXToolbox results to run a blacklist check. For Email 1:

• Is 91.215.42.118 on any blacklists?
• How many blacklists flag it?

Reverse DNS

MXToolbox shows the reverse DNS (PTR record) for each IP. Compare:

• Email 1: Does the PTR for 91.215.42.118 match the claimed hostname?
• Email 2: Does the PTR for 209.85.220.41 resolve to a Google domain?

Part 5: Document Your Findings

Create a header analysis report for both emails using this template:

EMAIL HEADER ANALYSIS REPORT
═══════════════════════════════
Analyst: [Your Name]
Date: [Today's Date]

SAMPLE 1: Invoice Email
  From (Display):    ACME Corp Billing <billing@acme-corp.com>
  Return-Path:       billing-noreply@acm3-invoicing.com
  Originating IP:    [your finding]
  Server Chain:      [list each hop]
  SPF:               [result]
  DKIM:              [result]
  DMARC:             [result]
  Blacklist Status:  [result]
  Verdict:           [MALICIOUS / LEGITIMATE / SUSPICIOUS]
  Key Indicators:    [list 3+ red flags]

SAMPLE 2: Password Reset Email
  From (Display):    Google Accounts <noreply@accounts.google.com>
  Return-Path:       noreply@accounts.google.com
  Originating IP:    [your finding]
  Server Chain:      [list each hop]
  SPF:               [result]
  DKIM:              [result]
  DMARC:             [result]
  Blacklist Status:  [result]
  Verdict:           [MALICIOUS / LEGITIMATE / SUSPICIOUS]
  Key Indicators:    [list supporting evidence]

Click to enlarge

Deliverable Checklist

Before completing the lab, ensure you have:

• Email 1 Received Chain — All hops traced with IPs, hostnames, and timestamps
• Email 1 Authentication Results — SPF, DKIM, DMARC verdicts documented with explanations
• Email 2 Received Chain — All hops traced and compared against Email 1
• Email 2 Authentication Results — All three checks documented
• Comparison Table — At least 3 specific header differences between the two emails
• Completed Analysis Report — Both emails with verdicts and supporting evidence

What's Next

In Lab PH.2 — Email Authentication Check, you'll go deeper into SPF, DKIM, and DMARC by querying DNS records directly. Instead of reading authentication results from headers, you'll verify the records themselves — understanding exactly what each policy says and how attackers exploit gaps.