Account Security Problems

How to Analyze a Suspicious Email and Message Headers in Microsoft 365

Muhammad Talha Oct 8, 2026 868 views

Question details

The user needs to investigate a potentially malicious email sent from Gmail to Microsoft 365 by analyzing its message headers, authentication status, and embedded links.

How to Analyze a Suspicious Email and Message Headers in Microsoft 365

Product: Microsoft 365
Device & OS: not provided
Scenario: Investigating a suspicious email by reviewing internet message headers, SPF results, and URLs to determine if it is a security threat.
Observed behavior: The message headers indicate the email was sent from Gmail to a Microsoft 365 recipient, and no questionable URLs were detected during the initial review.

Before you start

Ensure you do not click on any links, open any attachments, or reply to the suspicious email while investigating its headers.

Solution 1Recommended

Review Email Headers and Report to Microsoft

Check the authentication status in the raw email headers and report the message to Microsoft if it remains suspicious.

When you receive a suspicious email, reviewing the message headers can help you verify the sender's identity through SPF and DKIM authentication. Even if no immediate URL threats are found, it is highly recommended to report questionable emails to maintain your account's security.

Access the message headers

Open the email in your Microsoft Outlook client, click on 'File', select 'Properties', and scroll through the 'Internet headers' box located at the bottom of the window.

Check SPF and authentication results

Scan the header text for the 'Authentication-Results' line. Check if the 'spf' value states 'pass' or 'fail' to determine if the sending IP address is authorized by the domain.

Inspect embedded links safely

Carefully review the raw header text to identify the actual URLs the email contains, ensuring they do not redirect to unknown or deceptive domains.

Report the suspicious message

If the email appears to be a phishing attempt or malicious, use the Microsoft user-submission portal or the 'Report Message' add-in in Outlook to forward the email to Microsoft's security team for analysis.

Review Email Headers and Report to Microsoft

Header Analysis Limitations: A message passing SPF authentication does not guarantee it is safe. Compromised legitimate accounts can send authenticated but malicious emails. Always report suspicious messages.

Free Microsoft Office alternative

Manage Your Documents Securely with WPS Office

While you are securing your Microsoft 365 email environment, consider WPS Office as a free, lightweight, and easy-to-use alternative for all your document creation needs. It offers a familiar interface and seamless migration from Microsoft Office.

1. Download WPS Office: Navigate to the official WPS Office website and download the free installer for your operating system.
2. Install the Application: Run the setup file and follow the straightforward on-screen instructions to install the suite on your device.
3. Open Office Documents: Launch WPS Office and directly open your existing Microsoft Office files with perfect formatting compatibility.

Fully compatible with Microsoft Office formats, including Word, Excel, and PowerPoint.Free and lightweight, requiring minimal system resources for fast and smooth operation.Includes a built-in PDF toolkit to securely read, edit, and convert documents.Familiar user interface allows for immediate productivity without a steep learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

How do I find message headers in Gmail?

Open the email in Gmail on your web browser, click the three vertical dots (More) located next to the Reply button, and select 'Show original'. This will display the full email headers, including SPF, DKIM, and DMARC status.

What should I do if an email passes SPF but still looks suspicious?

Do not interact with the email content. Attackers can sometimes send malicious emails from compromised legitimate accounts that pass SPF checks. Report the email using the Microsoft user-submission portal immediately.

Can I get a virus just by viewing the message headers?

No, simply viewing the raw text of internet message headers will not execute malicious code or infect your device with a virus. Just ensure you do not click on any active links or download attachments from the email body itself.

Microsoft Office Security Issues