Example headers, analysed

Each message is invented, using reserved example domains and documentation IP addresses, but built to look exactly like what real mail systems write. Open one for the full analysis and what to learn from it, or load it into the analyser.

Looks genuine Genuine colleague, Google Workspace A normal, fully authenticated message between two companies that both use Google. The baseline every other example is compared with. SPF passDKIM passDMARC pass Looks genuine Newsletter via Amazon SES Bulk mail sent by a mail service on a company's behalf. SPF passes for the service's own domain, and DKIM is what ties it to the company. SPF passDKIM passDMARC pass Looks genuine Shop receipt via SendGrid A transactional email from a shop that set its sending service up properly: both SPF and DKIM align with the From domain. SPF passDKIM passDMARC pass Check carefully Mailing list + ARC Mailing lists add subject tags and footers, which breaks the author's DKIM signature. ARC lets the list pass on what it saw before it changed anything. SPF passDKIM failDMARC failARC pass Looks genuine Microsoft 365 to Microsoft 365 What Exchange Online headers look like: many internal hops with IPv6 addresses, 'Microsoft SMTP Server' as the protocol, and Microsoft's own compauth verdict. SPF passDKIM passDMARC pass Suspicious Spoofed bank alert A forged From address that fails every check. It only reached the inbox because the bank's DMARC policy is still p=none. SPF failDMARC fail Suspicious CEO fraud (display name) Everything passes, because the attacker used a genuine free webmail account. The trick is in the display name, which contains the boss's real address. SPF passDKIM passDMARC pass Looks genuine Delayed 3 h 51 min Four servers in three time zones and two very different delays. Converting every timestamp to UTC shows exactly where the time went. SPF passDKIM passDMARC pass Suspicious Look-alike (homograph) domain The attacker registered a domain that looks identical to the real one, with one Cyrillic 'а'. SPF, DKIM and DMARC all pass, for the wrong domain. SPF passDKIM passDMARC pass Check carefully Small business, SPF softfail Not every failure is an attack. This invoice is real, but the firm's web host isn't in its SPF record, it doesn't sign with DKIM and it has no DMARC record. SPF softfailDKIM noneDMARC none Looks genuine Forwarded with SRS A forwarding address that does it right: it rewrites the bounce address (SRS) so SPF still passes, and doesn't touch the message, so DKIM survives. SPF passDKIM passDMARC pass