Email Header Analysis: What SMTP Metadata Reveals About Infrastructure and Identity
The email your team flagged as probable phishing contains the attacker's entire infrastructure in 30 lines of plain text. Most analysts check 2 things: SPF pass/fail and the From address. The rest goes unread. Email headers are a complete infrastructure map. Every relay hop, server version, authentication result, and sending IP are preserved in plain text, and most senders, including attackers,…
The email containing probable phishing activity revealed a comprehensive infrastructure within just 30 lines of text. Analysts typically scrutinize SPF pass/fail and the From address, but email headers offer a wealth of information beyond these basics. Each relay hop, server version, authentication result, and sending IP are preserved in the email headers, providing a detailed infrastructure map.
Forensic analysts can access this reconnaissance data without relying on endpoint tools. The Received chain, added by relays, includes a timestamp and server identification, creating a non-forgeable routing path. While not every header carries the same forensic weight, the Received chain stands out as the most crucial metadata. Most headers, like X-Mailer, X-Originating-IP, and Message-ID, are sender-controlled and easily manipulated, making them unreliable sources for forensic evidence.
The forensic anchor lies in the Received chain, which details every relay hop, server specifications, protocol, and timestamp. A discrepancy greater than 120 seconds between hops suggests header forgery or a misconfigured relay. The boundary between RFC1918 private IPs and public IPs marks the corporate email entry point. The SLOW#TEMPEST campaign, identified in August 2024, routed Cobalt Strike payloads through Shenzhen Tencent Cloud (AS45090) infrastructure, which was visible in the ASN signatures of the Received headers.
The first external IP in the chain signifies the attacker's entry point into the internet postal system. Authentication-Results headers go beyond pass/fail, exposing authorized IP ranges, signing selectors, and enforcement status. SPF failures pinpoint the unauthorized sending IP, enabling immediate cross-referencing with threat intelligence databases.
DKIM selectors reveal the email provider that signed the message, highlighting anomalies like a banking domain signed by a consumer ESP. DMARC policy fields indicate the domain owner's choice not to enforce authentication, clearly communicated in plain text. Message-ID and X-Mailer headers serve as server fingerprints, exposing email server software, version, and generating host.
Attackers often disregard these fields, which uniquely identify the sending infrastructure. By analyzing the Message-ID format and X-Mailer header, analysts can distinguish between automated bulk sending tools and human-operated clients, potentially separating automated campaigns from targeted BEC attempts. A single sending IP in the Received chain reveals ASN ownership, provider abuse history, co-hosted domains, and campaign attributions, all accessible through IP-to-ASN lookups.
Passive DNS tools can map domains historically linked to the IP, providing a comprehensive view of the campaign's footprint.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
