An email that appears convincing on screen may be a poor piece of evidence. A display name can be changed, a signature copied and a message forwarded without its original technical context. When a disputed email may influence litigation, disciplinary action, fraud allegations or a criminal investigation, the question is not simply whether it looks genuine. The question is how to authenticate emails in a way that can be explained, tested and defended.
For legal and investigative purposes, authentication is a process of establishing what can reliably be said about a message: where it came from, how it travelled, whether it was altered, and whether the account or person alleged to have sent it can be connected to the activity. It requires preservation before interpretation. A screenshot alone will rarely answer those questions.
What email authentication means in an investigation
Email authentication has two related but distinct meanings. In information security, it usually refers to technical controls that help receiving mail systems assess whether a sender is permitted to use a domain. The principal controls are SPF, DKIM and DMARC.
In a forensic investigation, the term has a wider evidential meaning. The examiner must assess the source of the material, preserve the original data, examine message headers and account artefacts, validate technical findings, and report the limits of the evidence impartially. Passing an email security check does not by itself prove that a particular individual wrote or sent a message. Equally, a failed check does not automatically establish forgery.
That distinction matters in cases involving alleged impersonation, employee misconduct, contractual disputes, harassment, phishing, diversion fraud or contested communications in family proceedings. Technical findings must be tied to a clear evidential question rather than overstated.
How to authenticate emails without compromising evidence
The first decision is often the most important: preserve the message in its native form before anyone deletes, forwards, prints or edits it. Ask the holder not to interact with suspicious messages unnecessarily, particularly where a live compromise is suspected. Forwarding can remove or alter useful header information, and opening attachments may create security and evidential risks.
Where possible, obtain the original message file, such as an EML or MSG file, alongside the mailbox source from which it was acquired. A forensic acquisition of the relevant computer, mobile device or cloud mailbox may be necessary where authorship, deletion, access history or surrounding communications are in dispute. The scope should be proportionate. A narrowly targeted collection may be appropriate in a civil matter, while suspected criminality or account compromise may justify wider preservation.
Record who supplied the material, when it was received, the device or account involved, and every subsequent handling step. Calculate cryptographic hash values for acquired files and retain them with the exhibit record. This creates an auditable chain of custody and enables the examiner to show whether the data reviewed is the same as the data originally acquired.
Screenshots can still assist a witness in identifying what they saw, but they should be treated as illustrative material rather than the primary technical source. They commonly omit full headers, message routing information, hidden recipients, attachment metadata and the underlying message structure.
Preserve the surrounding context
An isolated message can be misleading. Collect the relevant message thread, inbox and sent-items position, related attachments, calendar invitations, account notifications and any evidence of reply or acknowledgement. Where justified, investigate relevant login alerts, password reset messages, forwarding rules and mailbox delegation settings.
Context can reveal whether an email was sent from the purported account, inserted into a mailbox, received through an external route, or generated after an account was compromised. It may also expose selective disclosure, where a party presents only the portion of a conversation favourable to their case.
Examine the email headers and message path
Full internet headers are the starting point for technical assessment. They contain fields created by mail servers as a message moves between systems, including `Received` lines, sending and receiving infrastructure, timestamps, message identifiers and authentication results.
An examiner will normally review the headers from the earliest apparent server entry through to final delivery. The sequence should be plausible, although no single header field should be accepted uncritically. Some fields are generated by the sender’s email client and can be manipulated. `Received` headers added by trusted recipient-side mail systems are generally more valuable than self-declared fields such as the visible From name, Reply-To address or date shown in an email application.
The following technical records are particularly relevant:
- The envelope sender, which may differ from the address displayed to the recipient.
- The `Message-ID`, which can assist in tracing a message within mail systems but is not definitive proof of origin.
- `Received` headers, which may indicate the route, originating infrastructure and timing of delivery.
- Authentication-Results headers, which record the recipient server’s SPF, DKIM and DMARC assessment.
- MIME boundaries and attachment details, which can expose alteration, encoding differences or mismatches between a supplied file and the message as transmitted.
Timestamp analysis requires care. Headers may use different time zones, server clocks may be inaccurate, and a displayed date can differ from the actual delivery time. A report should state the source of each time, normalise time zones where necessary, and distinguish observed facts from interpretation.
Test SPF, DKIM and DMARC properly
SPF, DKIM and DMARC are valuable corroborative controls, but each has limits.
SPF checks whether the server sending an email is authorised to send for the domain used in the envelope sender address. A pass supports the proposition that the sending infrastructure was authorised at that point. It does not prove the identity of the author, and forwarding arrangements can cause legitimate messages to fail SPF.
DKIM applies a cryptographic signature to parts of the email. A valid signature indicates that the signed content has not been altered after signing and that the signing domain controlled the relevant key at the time of verification. It can be strong evidence of message integrity, but it does not necessarily mean the displayed From address is genuine, nor does it identify the human user who composed the text.
DMARC uses domain alignment. It assesses whether SPF or DKIM passes in a way that aligns with the visible From domain, and it publishes a policy indicating how failures should be treated. A DMARC pass can strengthen confidence that a domain’s recognised sending arrangements were used. However, a pass cannot rule out compromise of a legitimate mailbox, and a failure may arise from forwarding, mailing lists or configuration errors.
Historical DNS evidence needs careful handling. A domain’s SPF, DKIM and DMARC records can change after an event. Testing only the records visible today may not accurately represent the configuration on the relevant date. Where timing is material, an examiner should identify this limitation and seek reliable contemporaneous evidence where available.
Corroborate the message with account and provider evidence
Email headers establish part of the transmission story. In disputed authorship cases, the stronger enquiry often sits behind the message itself. Was the alleged sender’s account accessed at the relevant time? From which IP addresses or devices? Were multi-factor authentication prompts approved? Was the message found in Sent Items, drafts, deleted items or synchronised devices?
Provider audit logs, where lawfully obtained and retained, may record account access, mailbox rule changes, message submission, administrative activity and security events. Corporate mail platforms can also retain audit trails showing whether a message was created, moved, deleted or accessed by another user with delegated rights. Retention periods vary, so urgent preservation action is often required.
A forensic examination of an endpoint may identify email client databases, cached messages, browser history, account tokens, relevant documents, attachment copies or artefacts of webmail access. These findings must be evaluated cautiously. The presence of an email on a device may show that it was received, viewed or synchronised; it will not always establish who used the device or who authored the message.
Report conclusions within the evidence
A defensible report separates established facts from opinion. It should identify the material examined, acquisition method, hash values, software and versions used, tests performed, results obtained, and any limitations. It should also explain technical terms in language a solicitor, client or court can follow without sacrificing accuracy.
Avoid conclusions such as “the email is unquestionably genuine” unless the evidence genuinely supports that level of certainty. More precise findings are usually more useful: for example, that the supplied EML file contains a valid DKIM signature, the message was accepted by specified mail infrastructure at a particular time, and provider records associate submission with a named account. Whether that account was used by the account holder, another authorised user or an intruder may remain a separate question.
Where the evidence is incomplete, say so. Missing server logs, a forwarded message without original headers, unavailable provider records and an unexamined device can all restrict the strength of an opinion. Transparency protects the integrity of the investigation and helps legal teams assess what further evidence should be sought.
If a disputed email may become evidence, preserve the original now, document its handling and obtain independent forensic assessment before the technical trail disappears. Early, disciplined action gives the facts their best chance of being heard clearly.