What all the stuff in email headers means —and how to sniff out spoofing

'I pretty frequently get requests for help from someone who has been
impersonated—or whose child has been impersonated—via email. Even when
you know how to "view headers" or "view source" in your email client,
the spew of diagnostic wharrgarbl can be pretty overwhelming if you
don't know what you're looking at. Today, we're going to step through
a real-world set of (anonymized) email headers and describe the
process of figuring out what's what.

Before we get started with the actual headers, though, we're going to
take a quick detour through an overview of what the overall path of an
email message looks like in the first place. (More experienced
sysadmin types who already know what stuff like "MTA" and "SPF" stand
for can skip a bit ahead to the fun part!)'

-- source: https://arstechnica.com/information-technology/2019/08/ars-forensic-files-how-to-parse-through-e-mail-headers-and-spot-obfuscation/

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list | [email protected]
Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug