You need to selectively read the things, even the from line can be very
interesting if you compare it to the one you see on a good valid message.
Normally the email client is also listed which can be a give away straight
away.
Brian

--
----- --
This newsgroup posting comes to you directly from...
The Sofa of Brian Gaff...

Blind user, so no pictures please
Note this Signature is meaningless.!
"Tim Lamb" wrote in message
...
In message , John Rumm
writes
On 22/12/2019 18:59, Tim Lamb wrote:
In message , John
Rumm writes
On 22/12/2019 11:23, Tim Lamb wrote:
Coincidence or....?
A few times recently I have had junk mails purportedly from my
daughters shortly after contacting them.
I post to a number of other folk without this happening. Is it my end
(limited anti-virus protection) or their end ( i-phone users)?
Suggestions?

First have at the full message headers of spoofed email. That will tell
you if it actually came from her mail system or an unrelated one. Look
for a SPF record in the header as well, and see what status is
attached to it (e.g. "Pass" or "Soft fail").
I have yet to find my way around T bird headers. This might be the
incentive. They display marked as probable junk but I would check anyway
because of the lack of content.

In thunderbird, just hit CTRL + U to display the full message source.

Right! 4 pages of gobbledegook:-)

Sent from jumbo.zone but otherwise nothing I understand. It obviously
passed all the authentication checks.

--
Tim Lamb