Best OSINT techniques for email address investigation?

I'm researching OSINT techniques specifically for investigating email addresses in phishing cases. I know about basic tools like Hunter.io and Have I Been Pwned, but what other techniques can I use to trace the origin of a suspicious email? Looking for both free and paid options. Thanks!