Lion Cipher Lab
Triage a suspicious email by reading its header
- SOC Analyst / Blue Team
- Beginner
- ~30 min
- Free · no account required
Why it matters
Surface tells catch most phishing, but not all — a careful attacker fixes the spelling, copies the logo, and picks a look-alike domain you might skim past. When the surface is ambiguous, the answer is in the header: the technical record every email carries. It shows the servers the message really passed through and the results of the automatic authentication checks (SPF, DKIM, DMARC) that a receiving mail system runs to test whether the sender is genuine. Learning to open that record and read three or four lines of it turns "this feels off" into "the machinery says this From address is…
What you'll learn
- reading full email headers
- following the Received chain
- reading Authentication-Results (SPF, DKIM, DMARC)
- header From vs envelope-from spoofing
- triaging a suspicious message
Steps in this lab
- The frame: your own inbox, read the record, touch nothing
- Open the full, original header
- Two senders, not one: the From you see vs the envelope-from
- Follow the Received chain — the path the message took
- Read the Authentication-Results: SPF, DKIM, DMARC
- Why a DMARC fail is a strong phishing signal
- Reach a verdict, then handle it correctly
- Why reading the header changes how you see email