let's say that someone sends me a business email on Microsoft outlook 365.

I save the email as an attachment (email.msg)

How a third person can make sure that the email attachment is not edited (sender name or content) when it's sent to him?

2 Answers 2


The authenticity of the mail can only be checked if the email was somehow signed (PGP, S/MIME) and it can be made sure that only the sender of the original mail had access to the signing key.


There are two sets of authenticity measures for email: organizational (a server's signature) and personal (an individual's signature).

Organizational – Server authenticity: DKIM is a system that can cryptographically sign mail passing through a relay. It signs specific headers as well as a cryptographic digest of the message body (including attachments), so you can at least verify that the message you're looking at is the same as was seen by the server(s) that signed it.

(Caveat: DKIM replay attacks exist, but they're limited in what they can do; they cannot change the content of signed fields, like the body.)

DMARC is an additional layer atop DKIM that helps you determine the DKIM signature's applicability. For example, Yahoo DKIM-signs all of its mail, so you know that Yahoo saw the scam that it delivered to you, but if its From header address is President Biden <biden@whitehouse.gov>, it's not a Yahoo signature you should be looking for. (That's a contrived example, I doubt Yahoo lets you send from unverified domains for this exact reason, but other services do.) Take a look at DMARC alignment for more.

Personal – User authenticity: It's extremely rare to find, but some people use PGP, PGP/MIME, or S/MIME to sign (and/or encrypt) their mail. This affects only the message body (MIME variants can include attachments).

Some people control their own domains and can use DKIM for this same general effect.

Addendum – Server authorization: While authorization is not content authenticity, it is still helpful in determining if an email was spoofed. DMARC, noted above, can verify content authenticity (based on aligned DKIM) or authorization (based on aligned SPF). SPF is a simpler process; a DNS entry lists all hosts allowed to send mail on behalf of a domain. You don't know if the .eml (or .msg) file was modified, but you can determine that it doesn't matter if it didn't claim to pass through a mail relay authorized by the domain's SPF. The domain's DMARC record will tell you how strong that signal is (p=reject vs p=quarantine vs p=none or no DMARC record).

(Caveats: Determining which is the right mail relay to look up can be nontrivial. Message modification cannot be detected with SPF.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.