## Email Anatomy: RFC 5322

To stop phishing, you must read the **Header**.

### The Envelope vs The Letter
*   **Envelope (SMTP)**: `MAIL FROM: attacker@evil.com`. (The server reads this).
*   **Letter (Header)**: `From: "CEO" <ceo@company.com>`. (The user reads this).
*   **Spoofing**: The attacker puts their real address on the Envelope (so the email arrives) but puts the CEO's address on the Letter (so the victim is tricked).

### Key Header Fields
*   **Received**: The hop-by-hop path. Read from **Bottom to Top**.
    *   `Received: from mail.evil.com [1.2.3.4]` -> **True Source**.
*   **Reply-To**: Often different from "From".
    *   "From: HelpDesk"
    *   "Reply-To: hacker@gmail.com"
*   **X-Mailer**: The software used.
    *   `PHP/7.4` -> Suspicious. Normal people use Outlook/Gmail, not PHP scripts.