Is This Email Real or a Scam? How to Check a Sender in 5 Minutes

The box above checks whether an address can receive mail. That's useful for spotting made-up and throwaway senders, but it is only one signal. Here is the full five-minute check.

Step 1: Find the real sender address

Email clients show the display name first: "Microsoft Account Team", "PayPal Billing", "IT Helpdesk". Anyone can type any name there. Click or tap the name to reveal the address behind it.

Look at the part after the @:

• [email protected] is a Microsoft domain.
• [email protected] is not. It's a separate domain that happens to contain the word.
• [email protected] is a free mailbox. Large companies don't send account notices from free mailboxes.

Then check the Reply-To. A message can show one From address and send your reply somewhere else entirely. If the Reply-To is a different domain or a free mailbox, that's a strong warning.

Step 2: Read the authentication results

Every major mail provider records whether a message passed SPF, DKIM and DMARC. You can see it:

• Gmail: open the message, the three-dot menu, then Show original. The top of the page lists SPF, DKIM and DMARC with PASS or FAIL.
• Outlook on the web: the three-dot menu, View, then View message source, and search for Authentication-Results.
• Apple Mail: View, Message, All Headers.

Paste the full header into the email header analyzer to have it laid out for you. What the results mean:

Result	What it tells you
DMARC pass for the brand's real domain	The message came from mail systems that domain authorises. Strong evidence it's genuine, though a hacked real account is still possible
DMARC fail	The From domain didn't authorise this message. If it claims to be a bank or a big brand, treat it as fake
SPF or DKIM pass, but for a different domain	A third-party sender signed it. Common for newsletters; check whose domain passed
No authentication at all	Unusual for a large company. Be suspicious

The details of the three checks are in SPF, DKIM and DMARC explained and what DMARC alignment means.

Step 3: Check for a lookalike domain

Scammers register domains that look right at a glance:

• an extra or missing letter: paypa1.com, micros0ft.com, arnazon.com (r and n side by side look like m);
• a hyphenated add-on: brand-support.com, brand-billing.net;
• a different ending: brand.co instead of brand.com;
• characters from other alphabets that look like Latin letters, shown in punycode as xn--....

Run the domain through the lookalike domain checker and the punycode converter if anything looks odd. Then check its age with the domain age checker. A domain registered days or weeks ago that claims to be a decades-old brand is a strong red flag.

Step 4: Check the address itself

This is where an address check helps:

• Does the mailbox exist? A sender address that can't receive mail was probably made up. Use the box at the top or the email checker.
• Is it disposable? Throwaway mailbox services are common in fraud. The disposable email checker flags known providers.
• Is it a free mailbox claiming to be a company? The business email checker tells free providers from company domains.
• Which provider runs the domain? The email provider lookup shows whether the domain's mail is handled by Google, Microsoft, a security gateway or something unusual.

Be clear about the limit: a real, working mailbox is not proof of a real company. Criminals open genuine free accounts, and they take over real business mailboxes. A mailbox check rules out fakes; it doesn't rule in honesty.

Step 5: Read the message like a sceptic

Content signals that should slow you down:

• urgency: "your account will be closed in 24 hours";
• a request to log in through a link, pay an invoice, buy gift cards, or change bank details;
• a link whose real destination (hover or long-press to see it) is a different domain from the sender;
• an attachment you weren't expecting, especially an HTML file or a zipped document;
• a familiar contact asking for something unusual from an address you haven't seen before.

Check links with the email link checker rather than clicking them.

Common scam patterns and how they fail the check

Pattern	What you'll usually see
Fake account alert from a big brand	Lookalike or unrelated domain, DMARC fail or no alignment, login link to a different site
Invoice or payment change request	Reply-To on a different domain, a young domain, pressure to pay today
Boss or colleague asking for a favour	Free mailbox using their name, or a domain one letter off yours
Job offer or "you've won"	Free mailbox, request for personal data or a fee

If it's a scam

• Don't reply, click or open attachments.
• Report it: Gmail and Outlook both have Report phishing in the message menu.
• If it imitates your employer or bank, forward it to their published abuse or security address.
• If you entered a password, change it at once from the real site and turn on two-step sign-in.

If you run a business: stop being the brand that gets faked

If customers get scam emails pretending to be you, the fix on your side is authentication. Publish SPF, sign with DKIM and move DMARC to an enforcing policy, so receivers reject mail that fakes your domain. Check where you stand with the DMARC checker and the email spoofing test. For sign-up forms, signup protection blocks fake and disposable addresses before they reach your list.

What it costs

Checking a single address is free in the box above. For lists:

• Pro, $39 a month: Unlimited email verification.*
• Starter, $9 a month: 2,500 emails a month.
• Free: 100 checks with a Google sign-in, no card.

*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off.

Upload a list on the verify page or see pricing.

More reading: the Gmail "message seems dangerous" warning, disposable email domains, business email vs personal email.