Security

Ask something
Discussion Locked

Read e-mail headers

0 helpful
11 replies

by editor's response

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Are you experienced with reading e-mail headers, as featured by Jonathan Yarden in the March 17 Internet Security e-newsletter? If so, do you have additional feedback that you think would help your IT peers learn? Let us know what you think about this topic and if the information is useful to you.

If you haven't subscribed to our free Internet Security e-newsletter, you're missing out on some great information. Subscribe today!

https://www.techrepublic.com/techmails.jhtml?repID=r001

11 replies

by dave howe

Comparing headers with a known-good message from the same source can be useful for deciding if a message is genuine - but bear in mind many people hop from ISP to ISP these days, and just because they send mail from one ISP today doesn't mean they can't send mail from another tomorrow; if you really want to be sure that a message is from who it says it is from, try SMime or PGP digital signatures (smime is built into a lot of email clients these days, and personal certs can be obtained for freefrom http://www.thawte.com/

by dave howe

Actually verifying a header chain is very much a black art - there are several ways around getting entries "logged" and spammers know them all.
A useful resource is spamcop (http://www.spamcop.net/) who have a free header-chain checking tool (they also offer a subscription email service that is heavily spam filtered; I have one I don't use largely as a way to contribute to the service, as the header scanner is *very* handy :)
The Spamcop service also has an automated "send complaint" functionthat identifies the abuse addresses for referenced sites and servers, and constructs the message for you - all you need do is press "send" :)

by editor's response

Here's an e-mail that we received from one of our readers:

I have found a freebie that helps about 99% of the time and works with most e-mail clients. It is called Saproxy. It is based on SpamAssassin and works quite well for the non header reader.
The combination of Outlook and Saproxy allow for auto delete of most spam. If you want, you can write your own rules too.

by h.j.miller,cisa,cdp

I can create rules in Outlook that will delete spam. But it takes a lot of time to go thru that menu. I use the Block Sender button frequently, but it is not being effective. I am seeing email that is obviously spoofed, with collegegirl@ dkjhajahwoir.com, etc., for which it is not possible to write a rule, as the website will change for every email. [Next time it will be weeiuqerpui.com, then fdjvnqefljbqeriuq.com,etc.] I am finding out why. I can use my bought and paid for MSN email account to spoof any source address I want, all courtesy of Microsoft. Thanks, Bill!! And I note that my address is accompanied by 16 other email addresses at cox-internet.com, indicating that someone recently hacked into my ISP and stole a list of email addresses. I would be willing to pay for an email spam filter, but it would have to be able to block these random addresses, rather than requiring me to write a rule for each one. If you know of such software, please let me know what its name is.

by editor's response

Here's a comment from one of our readers:

I'm using Nick Bolton's Mail Washer, that is an extremely useful program , especially the "bouncing" option. In other words, it's mostly like a pre-amplifier on HI-FI.

No way that junk can pass...

by rkclark0308

I've been using Mailwasher for a while now, in hopes that when the emails bounced back that I'd get taken off their list, but to no avail, the emails still keep coming.

by gshollingsworth

What about the web site address you are supposed to click on to "buy now" they thoughtfully include in the spam message?

Dig a little deeper in the HTML messages and you will likely find a few more addresses where images are being served.

Don't forget to investigate the "unsubscribe" link.

The originator of the spam is using all these ISP resources as well. They may be violating terms of use on many of these. Send a spam complaint to those site admins along with the other addresses you gather.

article comments:
I don't think average users will be able to grasp reading headers. That's the reason most e-mail clients don't display them by default.

Having to read headers is yet another cost spammers have unloaded on the general internet population.

by editor's response

Due to an editorial error, we provided incorrect steps for reading e-mail headers in Outlook. Here are the correct steps:

1. Right-click an e-mail message.
2. Choose Options.
3. Scroll through the Internet Headers box that's located at the bottom of the Options window.

We apologize for any inconvenience this may have caused.

This discussion is closed to new replies.