To preserve an account-recovery notice for investigation, export its full headers before you reply, forward, or delete it. Message headers are hidden lines that travel with the email and record routing and authentication checks. Those lines show where the message really came from. The Computer Forensics Lab notes that Received, Return-Path and Authentication-Results preserve routing and SPF, DKIM and DMARC verdicts that investigators use to trace origin.
Table of Contents
- What do recovery headers show?
- How do you save headers in Gmail and Outlook?
- How do you share headers without breaking them?
- Where should victims send the preserved evidence?
- Why can a passing check still mislead?
What do recovery headers show?
Received lines list each server that handled the message. Return-Path shows the bounce address, and Authentication-Results records the authentication verdicts.
SPF checks the sending server, DKIM checks a cryptographic signature, and DMARC enforces alignment with the visible From domain. CISA Binding Operational Directive 18-01 required federal senders to publish these controls with DMARC set to reject.
How do you save headers in Gmail and Outlook?
Act first and handle the original gently. Do not delete it, click reset links inside it, or reply before you save the evidence. Store the copy with the date, the account involved, and any related texts.
- In Gmail, open the recovery message, click the three dots, choose Show original, then download or copy the full header and body, according to Google Support in Google's Gmail help page.
- In Outlook on desktop, double-click to open the message, select File then Properties, and copy the text in the Internet headers box for archiving, according to Microsoft Learn in Microsoft's connectivity guidance.
How do you share headers without breaking them?
Forward a suspicious recovery mail as an attachment or save it as a file. The U.S.
Internal Revenue Service warns in IRS phishing-reporting guidance that inline forwarding rewrites headers and destroys original routing and authentication data. Paste saved headers into Microsoft's Message Header Analyzer to read hops, delays, spam verdicts, and authentication fields. Microsoft Learn describes the tool as a way to parse raw headers into readable form instead of reading raw text.
Where should victims send the preserved evidence?
Victims of business-email compromise and recovery-themed phishing can file at ic3.gov. The FBI Internet Crime Complaint Center asks for sender addresses, loss details, timeline, and available headers so investigators can trace infrastructure and pursue recovery.
Include the saved header file, the full body, and any attachment names. Keep the original message intact after filing in case an investigator needs more detail.
Why can a passing check still mislead?
Passing SPF, DKIM, and DMARC does not prove a recovery notice is legitimate. Attackers can abuse legitimate provider infrastructure or use display-name deception.
CISA's counter-phishing guidance for non-federal organizations stresses the same limit. Verify the request through a separate trusted channel, such as the provider's app or a bookmarked sign-in page, and keep the original intact.
You Might Also Like
- Cybersecurity for Support Case Attachments: How to Send Only the Records the Reviewer Needs
- Cybersecurity for Cloud Export Destinations: How to Review Sharing Permissions Before Delivery
- A Recovery Contact Mailbox Was Hacked: How to Assess Exposure of Appeal Correspondence