Email Analysis

Last modified: 2024-05-08


Detecting malware from messages, check if they are phishing.



Mosint is an automated e-mail OSINT tool.



Email Source Analysis

We can see the email source in each provider or execute the following commands.

open example.xml
strings example.eml

Check the following headers to distinguish whether it is spoofed.


Each value in dkim, spf, dmarc should be pass. If not, the email may be spoofed.


It should match the sender’s email address.


Its value should be pass. If its value is faile, softfail, neutral or none, the email may be spoofed.


Besides, check if the sender displayed name or address match From, Reply-To, Return-Path in headers. However, these header values can be modified by attackers so it could not be relied perfectly.

Check SPF, DKIM, DMARC Records of Domain

To confirm if these records exist in a domain, use dig command. If not exist, the domain may be spoofed, or may be categorized spam by some email providers.

dig txt

Also we can check that using online tools such as MxToolbox.

SPF Record

dig txt

# output example:  IN  TXT  "v=spf1 -all"  IN  TXT  "v=spf1 +ip4: -all"  IN  TXT  "v=spf1 -all"  IN  TXT  "v=spf1 -all"  IN  TXT  "v=spf1 mx -all"

Check DKIM Record

dig txt

# output examples:  IN  TXT  k=rsa;p=J8eTBu224i086iK  IN  TXT  " 0  IN  TXT  "v=DKIM1; p=ABC...123;""

To check DKIM record, we need to specify the DKIM selector. It can be found in s= header value of dkim section in email header such as Authentication-Results. For example,

  dkim=pass header.s=s1234 header.b=ABCDEF123

In this case, we execute dig []( txt .

Check DMARC Record

dig txt

# output examples:  IN  TXT  "v=DMARC1; p=reject;"

Be Careful of Fake Reply Message

If the email contains RE: (Regarding) which means replying your message, we need to check that it’s a really reply message. Attacker may impersonate reply message that victim communicated in the past.

Malware Detection in Attached Files

If you got email in which attached suspicious files, you need to investigate them.

  1. View the Message Source

  2. Copy the Attached File's Base64

  3. Change Base64 to SHA256

    sha256sum attached_file.doc
    # or
    echo -n 'abcde..==' > hash.txt
    sha256sum hash.txt

    Or there are some useful tools:

  4. Investigate the Hash

    There are some useful tools: