Today's

• Explanation of the importance of email header analysis in cyber
  security and forensic investigations.
• Overview of the components of an email header and their significance in identifying:
  • sender authenticity,
  • routing information,
  • and potential threats.

What is Email Forensics?

What is Email Forensics?

• The process of investigating and analysing email communication to detect cyber threats, fraud, and malicious activities.

Why is it Important?

• Identifying phishing attacks and email fraud.
• Tracing cybercriminal activities.
• Providing legal evidence in digital investigations.

Email Architecture

• Headers: Metadata about the sender, recipient, and email path.
• Body: The main content, including text and embedded links.
• Attachments: Files sent within the email, potentially containing malware.

Email Transmission Protocols

• SMTP (Simple Mail Transfer Protocol) Sending emails.
• POP3 (Post Office Protocol v3) Receiving emails, stores locally.
• IMAP (Internet Message Access Protocol) Receiving emails, stores on the server.

1. SMTP (Simple Mail Transfer Protocol) - Sending Emails

• For sending emails from a client to a mail server or between mail servers.
• Does not store emails but ensures delivery to the recipient’s mail server.
• Works on:
  • Port 25 (default, often blocked by ISPs)
    • used only for server-to-server relay
  • Port 587 (secure submission)
  • Port 465 (deprecated SSL - OUTDATED)

2. POP3 (Post Office Protocol v3) - Receiving Emails (Stores Locally)

• Used by email clients to retrieve emails from a mail server.
• Downloads emails to the local device and usually removes them from the server.
• Works on:
  • Port 110 (unencrypted)
  • Port 995 (SSL/TLS)

Best for single-device email access: emails are not accessible from other devices.

If the device is lost or damaged, the emails are lost unless they were backed up.

3. IMAP (Internet Message Access Protocol) - Receiving Emails (Stores on Server)

• Allows email clients to access emails stored on the mail server without downloading them.
• Syncs emails across multiple devices.
  • Changes made to emails (e.g., deleting, marking as read) on one device are reflected on all other devices.
• Works on:
  • Port 143 (unencrypted)
  • Port 993 (SSL/TLS)

Ideal for accessing emails from multiple devices while keeping them available on the server.

How email works?

Activity: Take 5 mins

What is the role of Email Header Analysis in Cyber Security

Why bother

• Analysing email headers is one of the most common tasks in digital forensics
• Establishing the identity of the email sender and receiver.
• Examining the authentication keys to identify if an email was forged.
• Investigating email-related crimes, such as phishing, fraud and harassment.

Understanding Email Headers

• Provide routing information about the email.

• Essential for tracing email origins and detecting spoofing.

• Key Fields to Analyse:

  • From: - Sender’s email address (can be spoofed).
  • To: - Recipient’s email.
  • Received: - Logs email transfer between servers.
  • Message-ID: - Unique identifier for tracking emails.
  • Return-Path: - Address to which non-deliverable mail is returned.

Understanding Email Headers: Example-2

Understanding Email Headers: Example-2

Understanding Email Headers: Example-2 Cont'

Email Authentication Protocols

1. Sender Policy Framework (SPF)

• An email authentication protocol that helps prevent email spoofing.
• Allows domain owners to specify authorised IP addresses for sending emails: allowlist.
• Key Benefits:
  • Prevents sender address forgery.
  • Mitigates phishing attacks.
  • Reduces fake sender email addresses.
• Limitations
  • SPF does not confirm email legitimacy, only verifies the sending server.
  • SPF breaks when emails are forwarded.

1.1 How SPF Works

2. Domain Keys Identified Mail (DKIM)

A method used to associate a domain name with an email using cryptography.

• Ensures emails are not tampered with in transit.
• Verifies the true ownership of the message.
• Uses public and private keys

2.1 How DKIM Works

• The sender's email server adds a cryptographic signature to the email header.
• The receiving mail server checks this signature against the public key in the sender’s DNS records.
• If the signature matches, the email is verified as legitimate.

Example DKIM Signature in an Email Header

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; bh=Y1JvGmW6p0+...3X5rQ==; b=E1yIb2...N1KfQ==

• d=example.com: Domain that signed the email.

• s=selector1: Selector used to locate the DKIM key in DNS.

• bh=Y1JvGmW6... : Hash of the email body.

• b=E1yIb2... : Cryptographic signature of the email.

• Why DKIM Matters:

  • Prevents email tampering
  • Helps detect spoofed emails
  • Improves email security & trust

3. Domain-based Message Authentication, Reporting, and Conformance (DMARC)

Checks for misalignment between the sender’s domain and the "From" field.

• Ensures the domain used in SPF/DKIM matches the displayed sender domain.

• What is Misalignment?

  • Occurs when the authenticated domain (SPF/DKIM) differs from the domain in the "From" field.

3.1 How DMARC Works

Example of DMARC

Why DMARC Matters?

• Prevents email spoofing
• Enhances email security
• Protects against phishing attacks

Example SPF, DKIM, DMARC

SPF, DKIM & DMARC Overview

Investigating Email Headers

Tracing an Email

1. Identify the originating IP address.
2. Analyse the Received: fields for email path.
3. Cross-check SPF, DKIM, and DMARC records to verify authenticity.

Tools for Header Analysis

• MXToolbox (Online)
• Google Admin Toolbox (Online)
• Header Analyser in Email Clients

Detecting Email Spoofing

Common Spoofing Techniques

• Display Name Spoofing: Attacker changes the sender name.
• Lookalike Domains: Using similar-looking domains (e.g., g00gle.com).
• Reply-to Address Manipulation: Mismatch between From: and Reply-To:.

Verifying Authenticity

• Check SPF, DKIM, DMARC.
• Compare Return-Path: and From: addresses.
• Analyse message headers for anomalies.

Recap: Email Header Analysis

• Check email components (headers, authentication fields).
• Review the "Received" field (trace email path).
• Verify "Reply-To" (ensure it matches the sender).
• Compare "Message-ID" & "From" fields (detect spoofing).
• SPF Alignment: PASS if Return-Path matches From domain.
• SPF Authentication: FAIL if sender's IP is not authorised.
• DKIM Alignment: Compare DKIM signature with From field.
• DKIM Authentication: Verify if DKIM signature is valid.

Email Forensic Tools: Popular Tools

• ExifTool - Extract metadata from email files.
• MailXaminer - Comprehensive email forensic analysis.
• Xplico - Packet capture and email analysis.
• Wireshark - Analysing SMTP traffic.

Lab

• Please review your labs from below:
  • Lab-1: Email Forensics
  • Lab-2: Email Header Analysis