Phishing Email Authentication and Safe Triage

Preserve before interacting

Retain the original message or approved export with headers, body, attachments, timestamps, and mailbox context. Do not forward it casually, click live links, or open files on a production workstation. Record what the recipient already did.

Forwarding can add headers, alter the body, drop attachments, or trigger remote content, so work from the mail platform’s preserved copy or an approved export. Record the reporting user, mailbox, folder, receipt time and zone, Internet Message-ID, current delivery state, and any clicks, downloads, replies, codes, or credentials reported. A screenshot is useful orientation but cannot replace routing fields, authentication results, exact destinations, or attachment bytes.

Separate email identities

Display name, visible From address, envelope sender, signing domain, return path, and infrastructure can represent different claims. Map each identity before deciding whether the message is authentic or expected.

Ask what each field is designed to assert. The visible From field is what the author presents; the envelope sender helps delivery and bounce handling; DKIM identifies a signing domain; Reply-To can redirect responses; Received fields describe transfer between systems. A legitimate service may use several domains, and a malicious sender may accurately authenticate a domain they control. Compare the identities with the claimed organization, expected workflow, and historical communication rather than searching for one decisive mismatch.

Interpret SPF DKIM and DMARC correctly

SPF evaluates permitted sending infrastructure, DKIM verifies a signed message and domain, and DMARC checks alignment and policy. A pass is not proof of benign intent, while forwarding and configuration can produce legitimate failures. Use source evaluation and corroboration.

Read the receiver’s authentication results and preserve which identity was evaluated. SPF normally applies to the envelope domain and sending IP; DKIM validates selected signed headers and body content; DMARC evaluates alignment of the visible From domain with an authenticated domain. Mailing lists and forwarding can change outcomes, while compromised or attacker-owned domains can pass. Authentication helps test domain use—it does not authorize the requested payment, login, or disclosure.

Inspect routes and payloads safely

Parse URLs and redirects without browsing from an exposed user context. Identify attachment type from structure rather than extension and use controlled static or dynamic analysis. Treat reputation as one observation with timing and coverage limits.

Preserve the displayed text and exact target, normalize carefully, and identify schemes, user-information tricks, subdomains, internationalized names, redirectors, tracking parameters, and final destinations. Do not remove parameters before understanding whether they identify a victim or campaign. For files, record hashes, real format, archive structure, signatures, macros or active content, and observed behavior in an authorized environment. Public scanning services may disclose confidential samples or notify adversaries, so follow policy.

Scope and contain proportionately

Search for related messages, recipients, clicks, downloads, sign-ins, process activity, and account changes. Choose containment based on evidence and consequence, preserve actions taken, and state what remains unknown.

Cluster by message identifiers, sender infrastructure, subject patterns, URLs, attachment hashes, and delivery time, while allowing attackers to vary each field. Remove or quarantine messages only with a recorded query and result count. If interaction occurred, extend into identity and endpoint evidence: revoke affected sessions, reset exposed credentials from a trusted device, and inspect mailbox rules or delegated access. Tell recipients what action to take without redistributing the lure.