Email Flow and Header Analysis

Email Flow and Header Analysis By:- Salah Ayman Haggag Email Follow is the path between the sender and the recipient. Email Header Analysis is the analysis of the details of the mail, and there are many protocols that allow the transfer of mail, including :SPF:- Verifies that the email comes from an authorized sender for the mentioned domain. DKIM:- Provides a digital signature for the email to verify its authenticity. DMARC:- Relies on SPF and DKIM and helps determine how suspicious emails are handled. Investigating Spoofed Headers Involves examining email headers to detect spoofing attempts and verify their validity. These are the basic steps of email delivery in a simplified and easy-to-understand manner:• The user sends an email using their Mail User Agent (MUA). • The MUA connects to the Mail Submission Agent (MSA) to deliver the message. • The MSA forwards the message to Mail Transfer Agents (MTAs) for routing to the recipient's Mail Exchange (MX) server. • MTAs route the message through multiple servers until it reaches the recipient's MX server. • The recipient's MX server receives and stores the message for the recipient's domain. • The recipient authenticates with the Mail Delivery Agent (MDA) to retrieve and read the message. You can analyze an email header through simple steps:• Identify Basic Information Start by identifying who sent the email and who it was sent to. • Examine Hops Look for fields related to "Received" to understand the path the email took. • Check Timestamps Look for the time when the email was sent and received. • Verify Authentication Check the authenticity of the email source using authentication protocols. • Detect Spoofing Look for inconsistencies in email routing to detect spoofing attempts. Email header fields:• To: This shows the recipient's email address. • Message-ID: Unique identifier of the email message, generated by the sending email server. • Subject: The email message subject written by the sender. • MIME-Version: Indicates the version of Multipurpose Internet Mail Extensions (MIME) used, typically 1.0. Content-Type Specifies the content types included in the email • Content-Transfer-Encoding: Specifies how the email message's MIME and body have been encoded for transfer. • References: Contains a list of message IDs for the original email and all replies, allowing tracking of the conversation thread. • Content-Length: Optional field indicating the size of the email message's body in bytes. Custom X-headers added by Yahoo to the email header:• X-Mailer: Identifies the email client used to send the email, helping to detect suspicious messages from uncommon or potentially malicious email clients. • X-YMail-OSG: Indicates Yahoo Mail's Outbound Spam Guard, a solution to prevent spam. • X-Sonic-MF: Likely refers to the sender's email address, although specific documentation for this header may not be readily available. • X-SONIC-DKIM-SIGN: Contains a custom DKIM signature for email authentication, ensuring the email's integrity. Email Authentication Overview:Email authentication aims to verify the identity and domain of the email sender to prevent spoofing and malicious attacks. This process is crucial for ensuring the integrity and authenticity of email messages. How Email Authentication Works:• Domain Setup: The domain owner defines authentication rules and publishes them in DNS records. • Authentication Process: When receiving email servers get emails from the domain, they authenticate them using the published rules. • Delivery Decision: Based on authentication results, the receiving server decides whether to deliver the email or block it. Email Authentication Protocols:• (SPF): Specifies authorized IP addresses or hostnames that can send emails for the domain. Receiving servers check SPF records to validate sender authenticity. • (DKIM): Adds a digital signature to emails, allowing receiving servers to verify that the email content hasn't been altered and comes from an authorized sender. • (DMARC): Combines SPF and DKIM to provide more comprehensive email authentication, including policies for handling failed authentication. Components of DKIM Signature:v: Version of DKIM, typically 1. a: Algorithm used for encryption and hashing (e.g., RSA with SHA256). C: Canonicalization algorithm for preparing header and body before hashing. d: Domain claiming authorization to send the email. s: Selector value for DNS lookup to retrieve the public key. t: Epoch timestamp indicating when the email was signed. bh: Base64-encoded hash of the email body after canonicalization. h: List of included headers in the signature. b: DKIM signature itself, calculated using header and body information with the sender domain's private key. Verification Process of DKIM Signature:• Hashing and Comparison the receiving server hashes the email body and compares it to the value in bh to ensure integrity. • DNS Lookup the server performs a DNS lookup using d and s to get the public key. • Decryption and Hash Comparison using the public key, the server decrypts b and compares it to a hash of header fields specified in h. • Verification if hash values match, DKIM signature is valid, and the email is considered authentic; otherwise, it may be rejected or marked as spam. Investigating Spoofed Email Authentication Result:• Email Header Analysis the investigation started by examining the email header of an email purporting to be from the fedex.com domain to the recipient's Gmail address. • Possible Spoofing the investigation raised the possibility of spoofing or a compromised mailbox within the fedex.com domain. • Authentication Result the analysis of email authentication results showed that SPF authentication failed, indicating that the email may not have originated from an authorized server within the fedex.com domain. • Lack of DKIM Signature additionally, the email lacked a DKIM signature for authentication, further suggesting potential spoofing. • Sender's Server IP the investigation revealed that the email was sent from the mailserver.footballticketnet.com server, with the last hop being the 95.211.214.81 server IP. • Conclusion based on the failed SPF authentication and absence of a DKIM signature, it was concluded that the email was likely spoofed, with the sender impersonating the fedex.com domain.