These questions are a bit broad and confusing. Email headers often look different for a host of reasons.
what the first hop is actually describing, in the sense that it is a
hop between the first Message Transfer Agent and the next one, meaning
that it is not representing the hop between the machine of the user
and the first mail exchange server, or could also represent this last
situation? (For example I am analyzing some emails and in some cases
the first hop is "from apache by "some domain" ", or "from user[IP
number] by "some domain" ")
The first hop is generally the first MTA reporting it received the message. "From Apache" just means the server that sent it was running Apache. Typically, the actual users IP address, if present, is found in the X-Originating-IP field.
if there is a hop in which there is the name of the mail exchanger and
also the IP next to it, in an enclosed parenthesis, but it looks like
that the IP is in another country, what does it mean?
The names you see in an email header are fully qualified domain names (FQDN). They identify a particular machine on the Internet and within that domain. The IP address in paranthesis is the IP address of that machine so if it resolves to a certain country, that is where the machine is located.
how should SPF
be interpreted (the check refers the machine of the sending server so
the first hop)?
SPF puts a record in DNS with a list of all IP addresses authorized to send mail on behalf of the domain. Recipient mail clients check to see if the MTA sending the message they are receiving has an IP address that falls within those ranges. If it does, there is usually a denotation in the header that says Pass. If it does not, several things can happen depending on how the SPF policy is configured:
- If the record ends in
-all, messages will not be allowed through and you will see a Fail denotation in the header.
- If the record ends in
~all, messages will be allowed through but they should be marked. You may see a None or SoftFail for these messages.
Other things that can be done is with regard to the hops is to check whether the FQDN's match up with the MX record for the domain. For instance, if sender Bob's domain foo-bar.com used Google to send mail, then you can expect to see Google FQDN's in his portion of the message path. This may at times require performing whois lookups on the domain names in question because they may not always be named in such a way that it will be obvious they belong to a certain organization.
Another test is to check whether the sending domain uses DKIM. If it does, and there is no DKIM signature present, that is a good indicator of a spoofed email.
