NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Email Header and Metadata Analysis
Master email header analysis. Learn to trace email origins, analyze SMTP routing, and extract metadata for phishing and BEC investigations.
Room tasks
1Reading Email Headers and Received Chains
2What Is Email Forensics and Why Does It Matter
3Detecting Spoofing (SPF, DKIM, DMARC Failures)
4Guided Lab: Tracing a Phishing Email to Its Source
Frequently Asked Questions
How do you analyse an email header?
Read the Received lines from bottom to top to follow the route, then check fields like From, Return-Path and Message-ID. Authentication results for SPF, DKIM and DMARC show whether the sender is trustworthy.
How can headers reveal spoofing?
Mismatches between the visible From address, Return-Path and sending servers, or failed SPF and DKIM checks, point to spoofing. Phishing analysis relies heavily on these signals.
Is email forensics difficult for beginners?
The basics are approachable once you understand SMTP routing. This free Codelivly room is rated intermediate and teaches how to trace origins and extract metadata through practical examples.