我收到的電郵是否真假

懶的說了... 標頭追蹤都那麼完整了，還說不是...

下面是一封來自 infoemail.microsoft.com 的郵件的信頭，已摘錄。

具體信頭如何判讀，請參考 RFC 文件，上面網址有簡要說明，主要從最上方的

Received:

開始追起，中間經過的 電腦 ，若有不可信者，可判定為 偽造

從 TY3PR01MB11223.jpnprd01.prod.outlook.com 追到 r12.customermail.microsoft.com 都是微軟內部 IP ，是可信賴的 Server ，所以可以判讀

這封郵件是使用廣告信發信軟體 nlserver, Build 7.0.0.10714

在電腦 IP 為 10.1.1.43 (Class A 私有 IP) 寄發到 r12.customermail.microsoft.com ，再由微軟內部轉信發到使用者信箱。

廣告信是不是微軟發出，就是這樣判讀。

範例為微軟發出的廣告信。

Received: from TY3PR01MB11223.jpnprd01.prod.outlook.com (::1) by

OSCPR01MB16067.jpnprd01.prod.outlook.com with HTTPS; Fri, 28 Nov 2025

19:05:43 +0000

Received: from SJ0PR05CA0059.namprd05.prod.outlook.com (2603:10b6:a03:33f::34)

by TY3PR01MB11223.jpnprd01.prod.outlook.com (2603:1096:400:3d7::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9366.14; Fri, 28 Nov

2025 19:05:42 +0000

Received: from CO1PEPF000044F7.namprd21.prod.outlook.com

(2603:10b6:a03:33f:cafe::19) by SJ0PR05CA0059.outlook.office365.com

(2603:10b6:a03:33f::34) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9388.4 via Frontend Transport; Fri,

28 Nov 2025 19:05:35 +0000

Authentication-Results: spf=pass (sender IP is 172.82.208.12)

smtp.mailfrom=infoemail.microsoft.com; dkim=pass (signature was verified)

header.d=infoemail.microsoft.com;dmarc=pass action=none

header.from=infoemail.microsoft.com;compauth=pass reason=100

Received-SPF: Pass (protection.outlook.com: domain of infoemail.microsoft.com

designates 172.82.208.12 as permitted sender)

receiver=protection.outlook.com; client-ip=172.82.208.12;

helo=r12.customermail.microsoft.com; pr=C

Received: from r12.customermail.microsoft.com (172.82.208.12) by

CO1PEPF000044F7.mail.protection.outlook.com (10.167.241.197) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.9412.0 via Frontend Transport; Fri, 28 Nov 2025 19:05:41 +0000

Received: from [10.1.1.43] ([10.1.1.43:39709] helo=r12.customermail.microsoft.com) by or2-prod1-mta-i-07daf5b784d0692cd (envelope-from ******@infoemail.microsoft.com) (ecelerity 4.4.1.20033 r(msys-ecelerity:tags/4.4.1.0^0)) with ESMTP id 1B/6D-58322-D42F9296; Fri, 28 Nov 2025 19:04:45 +0000

From: "Microsoft Rewards" ******@infoemail.microsoft.com

Date: Fri, 28 Nov 2025 11:04:41 -0800

Subject: =?utf-8?B?5oKo55qEIE1pY3Jvc29mdCBSZXdhcmRzIOW4s+aItumHjeimgQ==?=

=?utf-8?B?5pu05paw?=

Reply-To: "noreply" [email protected]

MIME-Version: 1.0

X-mailer: nlserver, Build 7.0.0.10714

Message-ID: ******@infoemail.microsoft.com

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-IncomingHeaderCount: 16

通常看信頭才能確定真假。
eMail 寄件者很容易偽造，所以以信頭為準。可以參考這篇：
https://tlcheng.wordpress.com/2025/01/19/smtp-%e4%bf%a1%e4%bb%b6%e6%98%af%e5%90%a6%e5%8f%af%e4%bf%a1%e8%b3%b4%ef%bc%9a%e7%b0%a1%e5%96%ae%e4%bf%a1%e9%a0%ad%e8%a7%a3%e8%ae%80/

感谢您提供的信息和截图，这封邮件并非来自微软。

请在网页浏览器中登录 OneDrive（https://onedrive.live.com/），如果 OneDrive 上没有显示任何问题，您可以安全地删除并忽略这封邮件。