Check a message

Is this email real?

Paste the top part of it. We will say how it was sent, whether the address was really used, and what to do next. It takes a second, nothing is stored, and there is no account.

First, who are you?

The evidence is the same either way. The advice is not: one of you needs to know whether to pay an invoice this afternoon, and the other can have a domain taken down.

You were sent it. We will tell you whether to trust it and what to do about it.

Paste the top part

Just the top part, called the header: who sent it and how it travelled. Never what the message says. Take your own address out first if you like. It doesn't change the answer.

GmailThe three dots, Show original, then Copy to clipboard
OutlookThe three dots, View, then View message details
Apple MailOn a Mac: View, Message, then Raw Source
YahooThe three dots, then View raw message

We do not keep the message, the addresses in it, or anything else about it. It is read in memory and dropped. Nothing you paste here is stored, and you are welcome to take your own address out of it before you do.

Four ways it's done

Only the first one shows up in a business's own email reports. The other three are visible to the person who received the message and to nobody else, which is why this page exists and why it is free.

1. Your exact address, forged

They send as you@yourbusiness.com. Enforcement stops this one dead: the message is refused before anyone sees it.

Your reports see this.

2. A look-alike address

One letter different, or a different ending. Your domain is never touched, so nothing of yours records it. A registrar will act on a factual report.

Only the recipient sees this.

3. Your name on somebody else's account

Your name in the part people read, sent from an ordinary Gmail, or through a platform like Patreon, Substack or Etsy where anybody can open an account in any name. Platform mail passes every check there is, because the platform really is sending it. No setting on your domain can prevent either. Telling your customers is what works.

Only the recipient sees this.

4. A real mailbox, broken into

Yours, or somebody else's in the same conversation. It passes every check because it is genuine. The reply address is often the giveaway.

Only the recipient sees this.

Check a Business's Email Setup Send It to a Person Instead

Copying the top part

Gmail, on a computer. Open the message. Click the three dots beside Reply, then Show original. On the page that opens, click Copy to clipboard and paste it here. The small box at the top of that page, the one listing SPF, DKIM and DMARC, is enough on its own.

Outlook. Open the message, click the three dots, then View and View message details, and copy everything it shows. In the older Outlook for Windows: File, Properties, then copy the box called Internet headers.

Apple Mail, on a Mac. Open the message, then View, Message, Raw Source. Select all of it and copy.

Yahoo. Open the message, click the three dots, then View raw message.

On a phone. Most mail apps can't show this part. Open the same mailbox on a computer. Forwarding usually strips it, so a forwarded copy tells us less, though we'll say what we can.

Your own address. Delete it first if you like, along with anything else you'd rather not send. We read who it came from and how it travelled, so the answer stays the same.

Get in touch