Substitution of the email sender, is it possible to find out by the header whether the substitution was on the side of the mail server or from the outside?

Question

Email

Greetings,
There was such a situation - they caught a spoofing attack on us, with the substitution of the sender.
Is it possible to find out on which side the substitution was made by the title of the letter? That is, is it just an attack from the outside, or did the owners of the mail provider that we use try to crank it up?

Answer 1

Можно и в заголовки не смотреть, т.к. если вы не опубликовали DMARC политику для своего домена ИЛИ на сервере провайдера не настроен фильтр DMARC (и то и другое почти наверняка, раз вы задаете такой вопрос), то подделать отправителя мог любой желающий в Интернет и ваш провайдер последний, кому это надо.

Answer 2

You can find out.
You may not know.
I can refigure the letter with a milter - my dear mother will not recognize! (libmilter, processing message headers directly at the time of reception. For this, of course, you need to write your own program)