# Email Header and Metadata Analysis

> Master email header analysis. Learn to trace email origins, analyze SMTP routing, and extract metadata for phishing and BEC investigations.

Canonical: https://codelivly.com/rooms/email-header-and-metadata-analysis
Last updated: 2026-09-17

| | |
|---|---|
| Level | Intermediate |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This module provides a deep dive into the anatomy of email headers and metadata. You will learn how to trace the true origin of an email, analyze SMTP routing paths, identify spoofing attempts, and extract critical forensic artifacts from email headers. By mastering email header analysis, you will be equipped to investigate phishing campaigns, Business Email Compromise (BEC), and spear-phishing attacks, providing actionable intelligence and legally defensible evidence for incident response.

## Lessons

1. Reading Email Headers and Received Chains (30 min)
2. What Is Email Forensics and Why Does It Matter (30 min)
3. Detecting Spoofing (SPF, DKIM, DMARC Failures) (30 min)
4. Guided Lab: Tracing a Phishing Email to Its Source (30 min)

## Related

- [Learning path: Cloud and Email Forensics](https://codelivly.com/learning-paths/cloud-and-email-forensics)
- [All rooms](https://codelivly.com/rooms)