New
#1
I would expect any genuine email from MS to show microsoft.com & not @e-mail.microsoft.com.
If you hover your mouse over the link what’s the url?
Sub-domains are hardly uncommon:
Subdomains are also used by organizations that wish to assign a unique name to a particular department, function, or service related to the organization.
Subdomain - Wikipedia
I think it is legitimate. I am an Insider all my Insider emails come from e-mail.microsoft.com. Microsoft is making changes to the Insider program, apparently with a new channel called Canary. In fact, they are already rolling it out on Windows 11.
Windows 11 Insider Canary Build 25314.1000 (rs_prerelease) - March 8 | Page 3 | Windows 11 Forum
Ben
When you hover your mouse cursor over the ‘update’ banner does it show a genuine MS link?
I know you state the header can be faked but you can analyse the header information here:
Message Header Analyzer if it is faked then I wonder if this would confirm or deny this.