Can I tell for certain that an email is spoofed?

Not from headers alone. Failed authentication and mismatched identities raise the likelihood, while a message that passes everything can still be malicious if the attacker controls the sending domain.

What is a display-name trick?

A From line such as a trusted address as the display name with a different real address after it. Many apps show only the display name, which can mislead.

Do forged Received lines happen?

Yes. A sender can add fake Received lines at the bottom of the message. Lines added by your own provider are the dependable ones.

Security

Published October 9, 20263 min read

How to Detect Email Header Spoofing

Technical indicators of spoofed headers, and why none of them is proof on its own.

Spoofing means making a message look like it came from someone else. Email was built without sender verification, so authentication standards were bolted on afterward. Detecting spoofing in headers means looking for places where the story told by different headers does not agree.

Check authentication first

Read the Authentication-Results added by your own provider. A DMARC fail for the From domain is the strongest header-level sign that a message was not authorized by the domain it names. SPF or DKIM failures matter less alone, since forwarding and mailing lists break them legitimately. Absent results are unknown, not a fail.

Compare the identities

Check	Why it matters	Often innocent when
From vs Return-Path domain	Shows whether SPF identity aligns with the visible sender	A mail service sends with its own bounce domain
From vs Reply-To	Replies may go somewhere else	A support desk or contact form is used
Display name vs real address	The display name can show a different address	A shared mailbox name contains an address
DKIM d= vs From domain	A signature from a different domain does not satisfy DMARC	A third-party platform signs the message

Look for header integrity problems

Multiple From headers: clients and authentication can look at different ones.
Duplicate Date or Message-ID headers.
Malformed Received lines, impossible IP addresses or timestamps that run backward.
Look-alike characters from mixed alphabets in a domain.

Each of these is an observation. Broken clocks and unusual software produce odd headers without any bad intent, so weigh them together.

Remember the Received chain can be forged at the bottom

Anyone can write extra Received lines into a message before sending it. Only the lines added by systems you trust are dependable, which is why the topmost lines carry the most weight.

Headers are not a verdict

Email headers can provide useful authentication and routing information, but they cannot by themselves prove that a message is safe or malicious. Look at the content, links and context as well, and confirm unexpected requests through another channel.

The Email Header Analyzer highlights these observations with severities and recommendations, without labeling a message phishing or safe. Site owners can reduce spoofing of their own domain by publishing SPF, DKIM and DMARC; the same careful approach applies to web headers reviewed with the HTTP Security Headers Analyzer.

Share headers safely

Headers contain addresses, IP addresses and server names. If you need to paste them into a ticket or chat, mask the sensitive values first with the Log Sanitizer, and only analyze messages you are authorized to inspect.

Frequently asked questions

Can I tell for certain that an email is spoofed?: Not from headers alone. Failed authentication and mismatched identities raise the likelihood, while a message that passes everything can still be malicious if the attacker controls the sending domain.
What is a display-name trick?: A From line such as a trusted address as the display name with a different real address after it. Many apps show only the display name, which can mislead.
Do forged Received lines happen?: Yes. A sender can add fake Received lines at the bottom of the message. Lines added by your own provider are the dependable ones.