It’s an unfortunate fact that when using email you will sooner or later receive an email pretending to be legitimate, trying to make you reveal information or click a malicious link. This is commonly called “phishing” and may attempt to lead you to a website that looks like for instance your bank, and then convince you to provide your login details.
Since it’s currently difficult to falsify the From (sender) information in an email you can usually trust the From address when determining whether an email is legitimate. In most cases you can therefore verify the authenticity of messages pertaining to be sent from Runbox staff by checking our list of Official Runbox Email Addresses.
By also reviewing the headers of an email you will most likely be able to tell for certain whether you can trust its contents. You can view the headers of an email in Runbox Webmail by first opening the message and then clicking the “View full headers” icon in the top right area of the message.
The best way to tell where a message was in fact sent from is the first (lowermost) Received entries. Received headers are added to a message every time a server processes it, the most recent header always above the previous one.
When reviewing the headers of a message the Received headers will therefore indicate a series of handoffs where each server on the way from sender to recipient accepts the message and passes it on to the next server.
Someone trying to trick you into believing a message is legitimate would be able to falsify the From entry (sender name and email address), but Received headers cannot be forged. It is however possible to add fake Received headers, so if there is a mismatch either with the timestamps or the server/domain names there might be something “phishy” about the message.
Here is an example of a legitimate Runbox message with valid email headers:
Reading the Received headers from bottom to top, we can see that each timestamp and server name matches the previous one. And because it starts at the bottom with “Received: … by mailfront04.runbox.com”, we can tell that the message was initially handled by a server on the runbox.com domain.
If there are any server or domain names in the Received headers that you don’t recognize or that don’t make sense, it’s reason to be cautious.
Usually you can also tell whether a message is legitimate by applying some common sense, especially regarding any links included in the message.