"Anyone can 'fake' the email address of a sender, but the encrypted headers contained in every email are tagged...
to the sender's PC. Also, your Internet service provider (ISP) is obliged to keep logs of all emails sent by their users."
Is it correct that the ISP will keep a full record of the emails, including content, and not just the tag to the PC? Presumably, it is possible for the recipient to leave the headers intact and change the information within the email?
Even if your colleague can show that the email originated from you, it may have still been sent by a malicious program that has infected your PC. Run a full virus scan on your machine to rule out this possibility. As things stand, an ISP doesn't have to save all of your email unless it is presented with a legitimate law enforcement request. There doesn't really seem to be a standard practice of what ISPs do and do not keep, so you'll need to check with your ISP for its current policy and practices.
The easiest way to trust an email's origin data is to use digital signatures, such as Pretty Good Privacy (PGP). This provides a way of ensuring that messages are from whom they appear to be from, verifying also that the message has not been altered in transit. When a message is digitally signed and sent, a unique mathematical value is calculated using a hashing or message authentication algorithm. This value is then encrypted with your private key, creating a digital signature for that specific message. This encrypted value is attached to the end of the message along with your digital certificate, which also contains your public key.
When the recipient's email program receives a signed message, it calculates its own hash of the message and then uses your public key to decrypt the sent email's hash value; the two values are then compared. If the two values match, you can be sure that the message has not been altered and was signed by you.
If the person you are sending an email to also has a digital certificate, you can sign and encrypt the email to ensure that it cannot be altered or read by anyone other than the intended recipient. Also, as a matter of good practice, I would always write an email as if it were a postcard, adding a salutation, date and time in the body of your messages. This ensures that the context of the message is clear.
Dig Deeper on Email and Messaging Threats-Information Security Threats
Related Q&A from Michael Cobb
Researchers developed a tool to help prevent improper certificate pinning that causes security issues. Expert Michael Cobb reviews the issue and the ...continue reading
Google Project Zero discovered a WPAD attack that could target systems running Windows 10. Expert Michael Cobb explains how the attack works and how ...continue reading
App trackers were found in hundreds of Google Play apps. Expert Michael Cobb explains the threat they pose and how GDPR has the potential to reduce ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.