To analyze a suspicious email, read the full headers for SPF, DKIM and DMARC results, compare the visible sender with the real return path, inspect link destinations without clicking, and judge what the message wants you to do. Never open attachments on a normal machine. Report the message and delete it.
What should you look at first?
Not the body. Start with the request. CISA's guidance lists common signs: urgent or emotional language, requests for personal or financial information, untrusted shortened links, and sender addresses or links with small errors. It also notes that perfect grammar is no longer a sign of safety, because AI tools can polish text.
If the message pushes you to act fast, pay, log in or share a code, that is a flag on its own.
How do you read the headers?
Most mail clients can show the full message source. Look for these fields.
- From: the visible sender. Easy to forge in the message itself.
- Return-Path: where bounces go. A mismatch with From is common in scams and also in legitimate bulk mail, so treat it as a clue only.
- Received: the chain of servers, read from the bottom up. The first external hop shows where the message really entered.
- Authentication-Results: the verdict from your receiving server on SPF, DKIM and DMARC.
SPF (RFC 7208) checks whether the sending server is authorized by the domain in the envelope sender. DKIM (RFC 6376) verifies a cryptographic signature tied to a signing domain. DMARC (RFC 7489) ties them to the visible From domain and tells receivers what to do on failure. A pass on all three means the message was authorized by the domain it shows, not that it is honest. Attackers register lookalike domains and authenticate them perfectly.
How do you check links and attachments safely?
Hover to see the destination, or copy the link text without opening it. Compare the real domain, reading right to left from the first slash. A link that looks like your supplier's name but ends in another registered domain is a mismatch. Be wary of shortened links and of pages that ask you to sign in after arriving from email.
For attachments, use an isolated analysis environment or let your security team handle it. Macros enabled documents, archives with passwords given in the message body, and unexpected invoices deserve extra suspicion.
Constructed example: the payment failed notice
An email claims an order payment failed and says to approve a new payment method. The sender shows a familiar store name. Headers show the Return-Path belongs to an unrelated domain, SPF passes for that domain, and DMARC fails for the visible From domain. The link text shows the store name, but hovering reveals a different registered domain with a login form.
Three independent clues agree: mismatched domain, failed DMARC alignment and a credential request. The right action is not to click, not to reply, and to report it using the mail client's report button.
What do you do after analysis?
If anyone clicked or entered a password, treat it as an incident. Change the password from a clean device, revoke active sessions, review mailbox rules for forwarding that an attacker might have added, and tell your security contact. Search the mail system for the same sender or link in other inboxes and remove them.
How to check or apply this
- Pause. Decide what the message wants you to do.
- Open the full headers and read Authentication-Results for SPF, DKIM and DMARC.
- Compare the From domain, Return-Path and first external Received hop.
- Inspect link destinations without clicking and note the real domain.
- Verify the request through a separate channel, such as a known phone number or the company's website typed by hand.
- Report the message and delete it. Do not reply or use the unsubscribe link.
- If anything was clicked or entered, reset credentials and check for mailbox rules.
Quick check
If SPF, DKIM and DMARC all pass, is the email safe?
No. They show the domain authorized the message. An attacker who owns a lookalike domain can pass all three.
Should I click the unsubscribe link on a suspicious email?
No. CISA advises deleting the message and avoiding every link, including unsubscribe links.
Sources
- CISA, Recognize and Report Phishing
- RFC 7208, Sender Policy Framework
- RFC 6376, DomainKeys Identified Mail Signatures
- RFC 7489, DMARC
Last reviewed: 18 October 2026.
