EMAIL ..Message Source (who & how)
When diagnosing the origin of an email, issues with email delivery or analyzing the properties of an email message, the message source (View Source) is the place to look. Scammers can fake the from email, however the message source will show the sending servers, and much more. It will look confusing, however, one can learn a lot from it without understanding all of the code.
Observation Points ...do they match the from address?
Received: from (look at sending server domain name & IP)
DKIM-Signature (good if sending server key present)
Received-SPF (pass if designates correct sender IP)
Trick ...point at the sender name, the email programs may then show the sender address, however, if it looks real one still needs to look at the message source code for the real origin. If it looks fake, junk it.
All mail programs will show the message source, however, how to view it will very.