{"id":3984,"date":"2026-06-29T14:02:12","date_gmt":"2026-06-29T12:02:12","guid":{"rendered":"https:\/\/websegely.hu\/?p=3984"},"modified":"2026-06-30T11:28:32","modified_gmt":"2026-06-30T09:28:32","slug":"what-does-an-analysis-of-an-email-header-actually-reveal-about-the-sender","status":"publish","type":"post","link":"https:\/\/websegely.hu\/en\/e-mail-fejlec-elemzese-mit-arul-el-a-felado-valojaban\/","title":{"rendered":"Analysing email subject lines \u2013 what does the sender really reveal?"},"content":{"rendered":"

 <\/p>\n

The in the previous article<\/a> We looked at how to spot suspicious emails at first glance. In this article, the Analysis of email headers<\/strong> will be the focus: we\u2019ll show you how to open them and what information can help you spot suspicious emails.<\/p>\n

\"Every<\/a><\/p>\n

We\u2019ll show you how to open them, which details are worth checking, and what they might reveal about the sender\u2019s true identity. You don\u2019t need to be an IT expert \u2013 with a few simple checks, anyone can more easily filter out suspicious emails. Analysing the email header will help you do this.<\/p>\n

Most people have a Gmail account and use the Gmail inbox. There, once you\u2019ve clicked on the message itself, you need to click on the three dots at the end of the subject line of the opened message and, in the drop-down menu, select the option labelled \u201eView original\u201d. This will open the \u2018Header\u2019 section in a separate window, where you\u2019ll find the same lines as those shown below.<\/p>\n

\"It\u2019s<\/a><\/p>\n

Many people might think that \u201eRight, I\u2019ve opened the email header. What should I look at now?\u201d<\/strong> \u2013 Right then, let\u2019s see what we need to look for and what we need to check!<\/p>\n

\"\"<\/a><\/p>\n

1. Analysis of email headers \u2013 Return-Path<\/span><\/h2>\n

Look for the \u201eReturn-Path\u201d line, which is underlined in green. This shows where the email would be returned to if it could not be delivered. In many cases, it matches the sender\u2019s email address, but the email may still be fake, as can be seen in this instance. It is worth checking whether the domain listed in the Return-Path actually belongs to the organisation that the sender claims to represent. In this instance, it is the Hungarian National Centre.
\nThe story falls flat right there: if you type \u201eMagyar Orsz\u00e1gos K\u00f6zpont\u201d into Google, interestingly enough, it\u2019ll bring up all sorts of similar results \u2013 just not this one. Because there\u2019s no such thing! And if we look at this email address letter by letter \u2013 \u201email@rlmItaly<\/span>.it<\/span><\/strong>\u201e, the word \u201eitaly\u201d appears, along with .it. Well, that\u2019s all there is to it \u2013 it\u2019s not an official Hungarian body.\u201d.<\/p>\n

2. Analysing email headers: what does the \u2018Received\u2019 line show?<\/strong><\/span><\/h2>\n

Look for the line marked \u201eReceived\u201d, which is underlined in blue. The second line underlined in blue will be the one that is most important to us.<\/p>\n

Why is it interesting?<\/strong><\/p>\n

Because this shows that:<\/p>\n