I think I received a phishing mail and I want to forward the email header/source to the company mentioned in the mail.

Is there any sensitive information in the header or source, besides the email text and addresses? For example, I saw that the antivirus (and version) used to check mail was mentioned.

  • What do you hope to accomplish by sending the email header to the company?
    – Tom K.
    Commented Apr 3, 2018 at 14:58
  • To show that the mail is legitimate and it comes from their domain (no change in the "reply to" field). The mail asks for some information that should not be required and is very suspicious and does not have any links to click. so maybe they got a mail account compromised...
    – LuisF
    Commented Apr 3, 2018 at 15:34
  • LuisF: reply-to isn't even intended to show where an email comes from, and without DKIM it isn't secured in any way, so for probably 98% of phish-food it is faked. Commented Apr 4, 2018 at 9:10
  • Ok Thank you, anyway the reply field points to their domain so the only way for the bad actor to get information is when I reply the mail (as there are no links or attached files in the original mail)
    – LuisF
    Commented Apr 4, 2018 at 9:47

1 Answer 1


It depends on what you classify as sensitive. The following is a (not comprehensive) list of things that could be contained in an email header that an attacker could make use of.

If you consider any of the following sensitive the answer is yes.

  • Sender and recipient email addresses
  • Server names, which could reveal FQDN of your internal domain
  • Your organisations public IP address
  • Information on servers that have handled the email
  • TLS/SSL info & what ciphers you use (or don’t use)
  • Banner information
  • Email gateway details
  • What Anti-Virus you use to scan email

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .