Spot the phish: five emails, two are genuine

Five sets of real-looking mail headers. Decide which are forged before you read the answers, then paste any of them into the phishing email analyzer to see what it would have told you.

This is a drill, not a lecture. Below are five sets of headers, trimmed to the lines that matter. For each one decide one thing: would you act on this message? Write your five answers down before you reach the answers, because the whole point is to find out what your reflexes do when nobody gives you a hint.

Two of the five are genuine. The other three are built the way real phishing is built, which is to say they mostly pass the technical checks. If that surprises you, that is the lesson, and the rest of the post explains why.

For a second opinion on any of them, paste the block into the phishing email analyzer. It runs in your browser and reads headers the way a mail server does.

How to read the block

Three lines do the work. Authentication-Results is the receiving server's verdict on SPF, DKIM and DMARC. header.from is the domain the DMARC check ran against, which is the domain you see in the From line. Reply-To, when it is present, is where your answer actually goes. Everything else is scenery.

Email 1

From: "Microsoft 365" <[email protected]>
Return-Path: <[email protected]>
Authentication-Results: mx.acme.com;
  spf=pass smtp.mailfrom=microsoft365-notices.com;
  dkim=pass header.d=microsoft365-notices.com;
  dmarc=pass header.from=microsoft365-notices.com
Subject: Unusual sign-in activity. Verify within 24 hours

Email 2

From: "Slack" <[email protected]>
Return-Path: <[email protected]>
Authentication-Results: mx.acme.com;
  spf=pass smtp.mailfrom=slack.com;
  dkim=pass header.d=slack.com;
  dmarc=pass (p=reject) header.from=slack.com
Subject: Priya mentioned you in #incidents

Email 3

From: "Anil Mehta (CEO)" <[email protected]>
Reply-To: <[email protected]>
Return-Path: <[email protected]>
Authentication-Results: mx.acme.com;
  spf=pass smtp.mailfrom=acme.com;
  dkim=pass header.d=acme.com;
  dmarc=pass header.from=acme.com
Subject: Are you at your desk? Need a quick favour, can't talk

Email 4

From: "Amazon Web Services" <[email protected]>
Return-Path: <[email protected]>
Authentication-Results: mx.acme.com;
  spf=pass smtp.mailfrom=amazonses.com;
  dkim=pass header.d=amazon.com;
  dmarc=pass (p=quarantine) header.from=amazon.com
Subject: Your AWS invoice for September is available

Email 5

From: "IT Helpdesk" <[email protected]>
Return-Path: <[email protected]>
Authentication-Results: mx.acme.com;
  spf=pass smtp.mailfrom=acme-it-support.com;
  dkim=pass header.d=acme-it-support.com;
  dmarc=pass header.from=acme-it-support.com
Subject: Password expires today. Reset now to avoid lockout

Stop here and commit to five answers.

Answers

Email 1 is phishing. Everything passes, and that is exactly the point: whoever sent it registered microsoft365-notices.com, published SPF and DKIM records for it, and so of course the checks pass. Authentication proves the mail came from the domain it claims. It never proves that domain belongs to Microsoft. The tell is the domain itself, plus the countdown in the subject.

Email 2 is genuine. The From domain is the real one, DKIM is signed by that same domain, and DMARC passed against a p=reject policy, which means the real owner would have rejected a forgery. The subject is ordinary. Nothing is asking you to hurry.

Email 3 is phishing, and it is the most dangerous of the five. The From address is a real acme.com address and every check passes, because it was sent through a service allowed to send as acme.com, or from a mailbox that was taken over, or simply because acme.com has a loose record. The giveaway is Reply-To: your answer goes to a Gmail account. Add "can't talk" and "quick favour" and this is the opening move of gift-card or wire fraud. The analyzer flags a diverging Reply-To for this reason.

Email 4 is genuine. It looks wrong if you only read Return-Path, which is a bulk-sending domain rather than amazon.com. That is normal: large senders bounce through a separate domain. What matters is that DKIM is signed by amazon.com and DMARC passed against the From domain. SPF and DKIM need not agree with each other; DMARC needs only one of them to line up with the From line.

Email 5 is phishing. Same shape as the first: a lookalike domain the sender controls, fully authenticated, with a same-day deadline. Your company's helpdesk writes from your company's domain. A brand-new domain with the company name baked into it is the most common form of credential phishing aimed at staff.

What the score means

Five out of five, and the Reply-To on email 3 jumped at you: you read headers for a living, or you have been burned once. Three or four: normal, and the gap is almost always emails 3 and 4, because they invert the rule people think they know. Two or fewer: you were deciding on the display name and the subject, which is the part the sender wrote for you.

The rule that survives this drill is short. Passing authentication tells you the domain is real. It tells you nothing about whether the domain is the one you meant. Read the domain, then read where a reply would go, then notice whether you are being hurried. The longer explanation covers why the checks were built this way.

Want a fresh one of these every morning? The Daily Adversary rotates forged headers through its week.