Parts of an email explained: From, SPF, DKIM and body | ORTSLAB

We are launching this blog with a series of articles dedicated to precisely defining how an email is structured, what parts compose it, and which elements need to be reviewed to determine the potential threats that may exist.

An email is not just what you see on screen. Behind the sender name and message text there is a complete technical structure: authentication headers, transport routes, DKIM signature and more. Understanding these parts is what allows you to tell a legitimate email from a fake one. Before analyzing fraud, spoofing, or social engineering techniques, it is essential to understand the complete anatomy of an email. A rigorous analysis is only possible through structural knowledge.

To better visualize this structure, here is a general diagram of the parts of an email:

1. Main Headers (Visible Headers)

• From: The address that appears as the sender.
• To: Recipient.
• Subject: Subject of the message.
• Date: Declared sending date.
• Reply-To: Reply address (may differ from the sender).
• Message-ID: Unique message identifier.
• Return-Path: Server's technical return address.

2. Authentication Headers

• SPF: Validation of the server authorized to send on behalf of the domain.
• DKIM: Cryptographic signature that guarantees message integrity.
• DMARC: Domain alignment and validation policy.

3. Transport Routes (Traceability)

• Received: Intermediate servers through which the message has passed.
• Source IP: Initial IP address of the transmission.
• Technical Geolocation: Location associated with the IP.

4. MIME Structure

• MIME-Version: MIME protocol version.
• Content-Type: Type of content (plain text, HTML, attachment).
• Boundary: Internal separators between message parts.
• Encoding: Content encoding method.

5. Message Body

• Plain text: Basic version without formatting.
• HTML: Enriched version with styles and links.
• Links: Visible URLs and actual destination.
• Embedded images: Resources loaded within the message.
• Attachments: Additional files.

6. Potentially Manipulable Elements

• Spoofing of the From field.
• Alteration of the Reply-To field.
• Visually similar domains (typosquatting).
• Links with visible text different from the actual destination.
• Malicious attachments.

Continuation

In the next article, we will begin to detail each of these components, explaining their actual function, how they can be manipulated, and which indicators allow for the identification of potential fraud or spoofing attempts.

Understanding the structure is the first step. The technical analysis begins next.