Is this email legit? Check a sender for scam and phishing warning signs
In short: Paste a sender address or the full headers: lookalike brand domains, a display name that doesn't match the domain, free mailboxes posing as support, domain age, disposable domains, Reply-To and authentication results. Limit: Signals, not a verdict: it never says a message is safe or certainly a scam.
To check if an email is legit, look at the sender's real domain, not the display name. Warning signs are a domain that imitates a brand (paypa1.com, microsoft-support.net), a brand name on a free mailbox, a domain registered days ago, a Reply-To on another domain, and a failed DMARC check. This tool lists the signs it finds; none of them is proof either way.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
[email protected] looks like PayPal, but PayPal doesn't send from it.
- Sender
- [email protected]
- Looks like
- PayPal
- Domain age
- 4 days
What this means for you
Warning signs, not a verdict. Go to the company's site or app yourself rather than using the message's links.
- Lookalike brand domains
- Name vs domain mismatch
- Domain age and disposable
- SPF, DKIM, DMARC from headers
- Phishing
- DMARC
- Lookalike
By SimpleVerifier Team · Last updated
Running a sign-up form? How do I check every new address?
- Export the sign-ups as a CSV.
- Upload them on the verify page; disposable and non-existent addresses are marked.
- Remove them before they reach your email list.
How do I check if an email is legit?
- Copy the sender from the message: the full From line with the name and address, or better, the full headers (Show original in Gmail, View source in Outlook).
- Paste it and press Check for warning signs. Headers are read in your browser; only the domain is looked up on our server.
- Read each sign. Strong ones (a lookalike domain, a brand name from the wrong domain, a failed DMARC) are reason enough not to act on the message.
- Whatever the result, never pay, share a code or log in from a link in the message; go to the company's site or app yourself.
Example
- You enter
"PayPal Support" <[email protected]>.- You get
- Strong warning signs: the domain looks like PayPal (look-alike characters) but isn't one PayPal sends from, and the name says PayPal from another domain. The domain is 4 days old. Paste the headers to also see SPF, DKIM and DMARC.
- Limits
- Headers are read in your browser; domain age is ten lookups a minute per visitor.
How can I tell if an email is a scam?
Look past the display name to the address, and past the address to its domain. Scammers rely on names that look right at a glance: a digit for a letter (paypa1.com), Cyrillic letters that look Latin, the brand plus a word (microsoft-support.net), or a familiar name on a Gmail or Outlook address. The FTC's phishing guide lists the same signs along with urgent requests for payment or personal details.
This checker shows the domain-level signs: lookalikes of about 35 commonly impersonated brands, a display name that names a brand the address isn't from, domain age from the registry, the disposable-domain list, whether the domain can receive replies, and a Reply-To on a different domain.
Is this email really from Microsoft, PayPal or Coinbase?
Paste the full headers. The receiving server records whether the message passed DMARC for the domain in the From address, in the Authentication-Results header defined in RFC 8601. A pass proves the domain sent it; a fail on a big brand's domain is a strong sign of spoofing, because those brands publish strict DMARC.
A pass is not proof the message is honest: a scammer can authenticate a lookalike domain perfectly, which is why the domain itself is checked too.
Who uses this tool, and for what?
- Anyone with an inbox
- Check a message that claims to be from your bank, a delivery company or a crypto exchange before clicking anything.
- Finance teams
- Check a supplier's "new bank details" email for a lookalike domain or a Reply-To that goes elsewhere.
- IT and security
- Give staff one place to paste a suspicious sender and see why it was flagged.
What can’t this tool tell you?
- Signals, not a verdict: it never says a message is safe or certainly a scam.
- Lookalikes are checked against about 35 commonly impersonated brands, not every company.
- It can't see the message body, links or attachments; only the sender and headers.
- Hacked real accounts pass every check here.
Common questions
- How do I know if an email is real or a scam?
- Check the sender's real domain for lookalikes, a brand name on a free mailbox, a very new domain or a failed DMARC. No single check proves it either way.
- Can a scam email come from a real company address?
- Yes, if the account was hacked. That passes every technical check, so be wary of unexpected requests for money or codes from anyone.
- Is it safe to reply to check if an email is real?
- No. Contact the company through its own website or app instead.
- What should I do with a phishing email?
- Don't click or reply. Report it with your mail app's Report phishing button and to the company being impersonated, then delete it.
- Does this tool tell me an email is safe?
- No. It lists warning signs it can see. Careful scams can show none, so treat requests for money, codes or passwords with care regardless.
Sources
Disposable detection is one check of several.
A domain can be perfectly ordinary and the mailbox still fake. This tool cannot tell you that.
- Real SMTP mailbox checks on every row of a list
- All 9,913 disposable domains applied automatically
- Catch-all and role-address detection alongside it
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.