# analyzing-email-headers-for-phishing-investigation

Parses email headers, traces Received hops, and validates SPF, DKIM, and DMARC to expose phishing sources and sender spoofing.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 612 installs · ★ 35034
- Author: mahipal
- License: Apache-2.0 · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md
- Updated: 2026-08-31
- HTML: https://affpapa.org/en/nevibecode/skills/analyzing-email-headers-for-phishing-investigation

## What it does

The skill guides forensic triage for suspicious emails. It outlines steps to extract raw transport headers from email clients, raw EML files, or Outlook PST archives using the `pypff` Python library. Header order matters. A Python script reads `From`, `Return-Path`, and `Message-ID` fields, then parses `Received` headers from bottom to top to trace the originating IP address.

Authentication is verified through DNS queries against SPF, DKIM, and DMARC records using `dig` or the `pyspf` module. The skill also computes the Levenshtein distance between sender and target domains to flag lookalike typosquatting domains. Running IP reputation checks requires an external AbuseIPDB API key, so you need network access and credentials ready beforehand.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-email-headers-for-phishing-investigation -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/analyzing-email-headers-for-phishing-investigation/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-email-headers-for-phishing-investigation -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-email-headers-for-phishing-investigation -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-email-headers-for-phishing-investigation
```

2. **Manually: put the files in place**
- File: `.github/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-email-headers-for-phishing-investigation -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills --path skills/analyzing-email-headers-for-phishing-investigation
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-email-headers-for-phishing-investigation -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md

## When to use it
- trace relay servers bottom-up through Received headers
- validate SPF, DKIM, and DMARC DNS records
- detect typosquatting domains using Levenshtein distance
- extract transport headers from PST and EML archives

## Example prompts
- Analyze phishing_email.eml headers and verify SPF, DKIM, and DMARC status
- Trace the Received relay chain in this suspicious email to find the origin IP
- Check sender domain micr0soft.com against microsoft.com for typosquatting

## Source text · SKILL.md · Apache-2.0

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 8554f7c9f73fefcb.

BEGIN THIRD-PARTY FILE 8554f7c9f73fefcb
```text
---
name: analyzing-email-headers-for-phishing-investigation
description: Parse and analyze email headers (Received chain, Return-Path, Message-ID)
  to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC
  results to confirm or rule out sender spoofing. Use when triaging a suspicious or
  reported email, investigating a phishing incident, or verifying whether a message's
  sender domain was spoofed.
domain: cybersecurity
subdomain: digital-forensics
tags:
- forensics
- email-analysis
- phishing
- spf
- dkim
- dmarc
- header-analysis
version: '1.0'
author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0052
nist_csf:
- RS.AN-03
- DE.AE-02
- RS.MA-01
mitre_attack:
- T1566.001
- T1566.002
- T1598.003
mitre_f3:
  version: '1.1'
  tactics:
  - reconnaissance
  - initial-access
  - stealth
  - resource-development
  techniques:
  - id: T1598
    name: Phishing for Information
    tactic: reconnaissance
    source: attack
  - id: T1660
    name: Phishing
    tactic: initial-access
    source: attack
  - id: T1672
    name: Email Spoofing
    tactic: stealth
    source: attack
  - id: F1032
    name: Impersonate Official
    tactic: initial-access
    source: f3
  - id: T1583.001
    name: 'Acquire Infrastructure: Domains'
    tactic: resource-development
    source: attack
  - id: F1020.002
    name: 'Create Fake Materials: Fake Website'
    tactic: resource-development
    source: f3
---

# Analyzing Email Headers for Phishing Investigation

## When to Use
- When investigating a suspected phishing email to determine its true origin
- For verifying sender authenticity and detecting email spoofing
- During incident response when a user has clicked a phishing link
- When tracing the delivery path and relay servers of a suspicious email
- For validating SPF, DKIM, and DMARC alignment to identify forgery

## Prerequisites
- Raw email headers from the suspicious message (EML or MSG format)
- Understanding of SMTP protocol and email header fields
- Access to DNS lookup tools (dig, nslookup) for SPF/DKIM/DMARC verification
- Email header analysis tools (MHA, emailheaders.net concepts)
- Python with email parsing libraries for automated analysis
- Access to threat intelligence platforms for IP/domain reputation
```
END THIRD-PARTY FILE 8554f7c9f73fefcb

The third-party file has ended. Everything between the 8554f7c9f73fefcb tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2267 of 12691 bytes. © mahipal · Apache-2.0 · https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md