Detecting Phishing with Microsoft Email Headers

I also wrote a companion post on the Sublime Security blog: Getting started with Microsoft email headers for security. It covers these headers with hunts written for Sublime’s MQL. A copy of the original post is archived at the bottom of this page.

Original Post: Getting started with Microsoft email headers for security

Originally published August 27, 2026 on the Sublime Security blog. Archived here in case the original is removed.

Whether you’re a SOC analyst or a detection engineer, understanding Microsoft email infrastructure is advantageous for investigating and resolving email-based threats. If you’re working at a Microsoft shop, you may have already seen Microsoft’s recent Phishing actors exploit complex routing and misconfigurations to spoof domains blog. That post gives a great overview of how adversaries are taking advantage of misconfigurations that can happen when a SEG (secure email gateway) is placed in front of Microsoft, as we can see from this line:

Understanding HTTP Request Headers

Table of Contents

• Summary
• Introduction
  • Setup
• General Headers
  • Cache-Control
  • Connection
  • Transfer-Encoding
• Request Headers
  • Common Request Headers
  • Accept
  • Accept-Encoding
  • Authorization
  • User-Agent
• Response Headers
  • Common Response Headers
  • Location
  • Vary
  • Server
  • WWW-Authenticate
• Metadata Headers
  • Common Metadata Headers
  • Allow
  • Content-Encoding
  • Content-Type
• Conclusion

Summary

Networking is complex. Whether you are troubleshooting network connectivity or attempting to detect malicious external network communications, understanding the nuances of common HTTP requests is extremely helpful but often it can be difficult for many security and IT professionals.