How to analyze a phishing email (.eml) step by step

A suspicious email arrives. Before forwarding it to "not sure who" or —worse— clicking to "see what it is", analyze it methodically. The key: work on the file, not on the live message. No clicking, no opening attachments, no loading remote images (they confirm to the attacker that you exist).

1. Get the .eml with full headers

The .eml is the whole message as text: headers + body + encoded attachments. In most clients: Forward as attachment or Save as…. In Outlook, drag the message to the desktop; in Gmail, "Show original" and "Download message". Without full headers there is no analysis.

2. Read the headers: the email's real journey

The Received: headers are read bottom to top: the lowest is the first hop (the origin). Look for:

• Return-Path / envelope-from vs. what you see in From:. If they don't match, bad sign.
• Reply-To pointing to a domain different from the sender (replies go elsewhere).
• Inconsistent hops/times, or an origin IP/country that doesn't fit the supposed sender.

3. Is it authenticated? SPF, DKIM and DMARC

Find the Authentication-Results: header. That's the receiver's verdict:

Authentication-Results: mx.google.com;
   spf=fail (google.com: domain of ...) smtp.mailfrom=...
   dkim=none;
   dmarc=fail (p=NONE) header.from=your-bank.com

An spf=fail or dkim=fail combined with a From: from a known brand is a huge red flag. Note: passing SPF/DKIM doesn't guarantee legitimacy (the attacker can authenticate their look-alike domain); what matters is alignment with the domain it claims to be.

4. Sender and links

• Display name vs. real address: "Bank Support <random@weird-domain.top>". The display name means nothing.
• Look-alike domains (typosquatting): micr0soft.com, paypa1.com, or misleading subdomains like bank.com.secure-login.top (the real domain is secure-login.top).
• URLs: check the link's real target, not the text. Beware of shorteners and of @ inside the URL. Before pasting a URL into a ticket or chat, defang it so nobody opens it by mistake.

5. Attachments: without opening

Don't open anything. From the .eml you can extract the attachment and get its hash (SHA-256) to look it up in threat-intel sources without running it. Beware of .html, .iso, .img, .lnk, Office macros and double extensions (invoice.pdf.exe).

6. Extract the IOCs and report it

Gather the indicators: domains, URLs, IPs, sender addresses and attachment hashes. Defang them, document what you saw and report it to your SOC or the abuse mailbox. If you're the end recipient, mark it as phishing in your client and delete it; do not reply.

Red flags (recap)

• Urgency and threats ("your account will be closed in 24h").
• From that doesn't align with SPF/DKIM/DMARC.
• Look-alike domains or misleading subdomains in the links.
• Unexpected attachments or dangerous types.
• Reply-To different from the sender and generic greetings.

Analyzing phishing methodically is quick and takes away the fear of "what if it was real?". The answer is almost always in the headers.

Sergio Belmonte Morales
Cybersecurity Analyst · SOC · Sentinel/KQL specialist