I have come across certain scenarios which confuses me on how it is possible to manipulate email headers.

The person who received an email(A) from person (B), forwarded me (C) the email as Original attachment.

Scenario 1:

While analysing the email headers I am seeing the From property of the email header is showing C instead of B.

Scenario 2:

While analysing the email headers, I am seeing the To property of the email header is showing B instead of showing A.

How is this made possible and is there a way to validate the right sender/receiver?

  • Email is just plaintext. Anyone can edit the header once received.
    – schroeder
    Mar 4 '20 at 7:39
  • @schroeder here we are assuming that A is a trusted sender when forwarding the email to C. Did you mean, the content of email is edited while in transit from A to C? Mar 4 '20 at 16:18
  • No, I mean that the person sending you the emails as an attachment can edit them
    – schroeder
    Mar 4 '20 at 19:39
  • Thanks for clarifying. Here the email as an attachment is forwarded using Phish Alert button in Outlook by the sender Mar 6 '20 at 4:14
  • Ah, that's a very relevant detail. Check the email server logs for those messages and see what the server says. Then work with the technical support for the Phish button to see if their process might have altered the headers.
    – schroeder
    Mar 6 '20 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.