Lion Cipher Lab
Read email headers to triage a suspicious message
- SOC Analyst / Blue Team
- Beginner
- ~30 min
- Free · no account required
Why it matters
"Is this email real?" is a question a defender is handed constantly, and the header — the metadata every message carries but almost nobody reads — usually holds the answer. Attackers rely on you judging a message by the friendly name in the From line, which they fully control; the header is where the message's actual path and its authentication results are recorded. Learning to open the raw header, follow the Received: chain back to where the mail really originated, and read the SPF, DKIM, and DMARC verdicts turns "it looks official" into a defensible yes-or-no. It is a genuine day-one SOC…
What you'll learn
- reading raw email headers
- tracing Received: hops
- interpreting SPF / DKIM / DMARC results
- spotting display-name spoofing and lookalike domains
- querying SPF and DMARC records with dig
- knowing the honest limits of header analysis
Steps in this lab
- Why the header is where the truth lives
- Open the raw headers of your own message
- Trace the Received: hops back to the origin
- SPF — did an authorised server send this?
- DKIM — was the message signed and unaltered?
- DMARC — the tie-breaker built on alignment
- The human layer: display-name spoofing and lookalike domains
- What headers can and cannot tell you