Reading Email Headers to Spot Return-Path and From Mismatches
Phishing campaigns targeting Australians have become more sophisticated, with scammers frequently impersonating the Australian Taxation Office, myGov, and major banks. During tax time, fake "ATO refund" emails surge in volume, often arriving in inboxes in Sydney and Melbourne where recipients are busy finishing end-of-financial-year work. A closer look at the email header can reveal whether the message really came from the domain it claims to represent.
The simplest way to detect a spoofed sender is to compare the domain shown in the "From" field with the one used in the "Return-Path" header. When these two values do not match, the email is almost certainly forged. Running the suspicious message through a domain reputation tool such as Trusted Sender Score gives an instant verdict on whether the sending domain is trustworthy.
What an Email Header Actually Contains
Every email carries a hidden block of metadata that travels ahead of the message body. This block includes the originating IP address, the authentication results for SPF, DKIM, and DMARC, the message ID, and routing information from each server the email passed through. In Outlook, view this by clicking the three dots and choosing "View message source". Gmail users on Australian accounts can choose "Show original" from the three-dot menu.
For organisations bound by the Privacy Act 1988 and the Notifiable Data Breaches scheme, this hidden layer is more than a curiosity. A spoofed email that leads to a credential breach can trigger mandatory reporting obligations to the Office of the Australian Information Commissioner. Understanding header structure is therefore a frontline control, not just a forensic exercise.
The two fields most relevant to spotting impersonation are "From" and "Return-Path". The From field is what the recipient sees by default in their inbox. The Return-Path, sometimes called the "envelope sender" or "bounce address", is what the receiving server uses if the message cannot be delivered. Under normal circumstances these values belong to the same domain.
Locating the Return-Path in Common Mail Clients
In Apple Mail on macOS, the Return-Path appears at the very top of the raw source. Outlook web users find it near the top of the header pane, while Thunderbird displays it under "View Source". On mobile devices the process is clunkier, which is why many Australian security teams prefer to forward suspicious messages to a desktop account before analysis.
Once located, copy both the From and Return-Path values into a plain text editor side by side. If the domains differ, the email deserves further inspection. Tools like the platform's SPF and DMARC checkers can confirm whether the alleged sending domain is authorised to send on behalf of the From address.
A common confusion arises with legitimate bulk senders. Marketing platforms, newsletter services, and event-management tools sometimes rewrite the Return-Path to use their own subdomains, for example bounces.messaging.example.com.au, while the From still shows the client brand. The relevant test here is whether SPF, DKIM, and DMARC all pass for the brand domain listed in the From field.
Recognising Common Mismatch Patterns Used by Scammers
A popular trick during the Australian EOFY period is to display a From address such as "ATO Refunds refunds@ato.gov.au" while the Return-Path points to a free webmail account or a freshly registered look-alike domain. The header will also typically fail DMARC alignment, which is the technical rule requiring the visible sender to match the authenticated sender.
Another frequent pattern is the use of subdomains of large foreign providers, such as @gmail.com or @outlook.com, paired with a From display name suggesting an Australian institution. The ACSC's annual cyber threat report consistently lists business email compromise among the top categories of cybercrime reported in Australia, and header mismatches are at the heart of most of these attacks.
A subtler pattern involves look-alike domains. A scammer might register "commbank-secure.net" or "mygov-id.com.au" and use it as the Return-Path, while the From pretends to be the real bank. These are easy to miss if you only glance at the visible sender. Check the registered domain, not the words that come before the final dot.
Walking Through a Header Inspection Step by Step
Start by opening the suspicious email in a desktop client and loading the raw source. Search for "Return-Path:" using Ctrl+F or Cmd+F. Copy everything between the colon and the next angle bracket. Repeat the step for the line beginning with "From:" to extract the visible sender's address.
Strip both values down to their domains. If the From shows "notifications@bigbank.com.au" and the Return-Path shows "bounces@mailer.suspiciousprovider.ru", you have a textbook mismatch. Document both domains, then check the reputation of each. A quick lookup will show whether the suspicious domain has been flagged in threat intelligence feeds.
Finally, examine the authentication results. Look for lines starting with "Authentication-Results:" and read whether the SPF, DKIM, and DMARC checks passed or failed. A DMARC failure combined with a From-to-Return-Path mismatch is decisive evidence of spoofing. Report the email to the ACSC via ReportCyber and delete it from your inbox.
Comparing a Legitimate Header with a Spoofed One
| Header Field | Legitimate Email | Spoofed Email |
|---|---|---|
| From | newsletters@bigbank.com.au | refunds@ato.gov.au |
| Return-Path | bounces@mailer.bigbank.com.au | random_user1990@xyzhost.ru |
| SPF | Pass | Fail |
| DKIM | Pass | None or Fail |
| DMARC | Pass | Fail |
| Reply-To | support@bigbank.com.au | different domain |
| Originating IP | Known platform range | Residential or VPS abroad |
A genuine email keeps the brand domain consistent across the visible sender, the envelope sender, the signing domain, and the replying address. Any deviation deserves a second look, and any DMARC failure should be treated as confirmation that the message is not what it claims to be. Australian businesses operating under the Security of Critical Infrastructure reforms and voluntary Essential Eight guidance are encouraged to include header inspection in their standard phishing response runbooks.