Is This Email Legit? How to Tell If an Email Is Real or a Scam
The quick answer: look past the display name to the real sending address, hover over links before clicking, and check whether the message passed SPF, DKIM and DMARC. If anything asks you to pay, log in or "verify your account" in a hurry, contact the company yourself using a phone number or website you already know, not anything in the email.
Check an email's headers nowPaste the headers to see where it really came from. Free, runs in your browser.Two different questions
People type "is this email legit" for two reasons. Sometimes they got a message and want to know if it's a scam. Other times they have an email address and want to know if it's real and can receive mail. This guide covers the first. For the second, use the free email verifier or read how to verify an email address.
A 60-second checklist
- Read the real sender address, not the name. "PayPal Support" can be sent from any address. Click or tap the name to see the address behind it. A bank won't write from
@gmail.com, and watch for lookalikes such aspaypa1.com,amaz0n-help.comor extra words likeapple-billing-secure.com. - Check where links really go. On a computer, hover over a link and read the address that appears at the bottom of the window. If the text says one site and the link goes to another, don't click.
- Look at the Reply-To. If you hit Reply and the address changes to something unrelated, that's a common scam trick.
- Notice pressure. "Your account will be closed in 24 hours", "unusual sign-in, confirm now", unpaid invoices you don't recognize and gift card requests are the classic signs.
- Be careful with attachments. Unexpected
.zip,.html,.htm,.isoor Office files that ask you to "enable content" are high risk. The attachment checker explains file types before you open anything. - Check the authentication results. Copy the full headers into the email header analyzer. It shows the servers the message passed through and whether SPF, DKIM and DMARC passed.
What SPF, DKIM and DMARC tell you
| Result | What it means | What it doesn't mean |
|---|---|---|
| SPF pass | The sending server is allowed to send for that domain | That the domain itself is trustworthy. Scammers set up SPF on their own lookalike domains too. |
| DKIM pass | The message wasn't changed after it was signed, and the signing domain is shown | That the signing domain is the company you think it is. Read the domain. |
| DMARC pass | The visible From domain matches a domain that passed SPF or DKIM | That the content is honest. It proves who sent it, not whether they're nice. |
| Fail or none | The message may be spoofed, or the domain isn't set up properly | Always a scam. Small businesses often have broken settings. Treat it as a warning, not proof. |
The best combination to see is DMARC pass on a domain you recognize, spelled exactly right. You can also check any company's published settings with the MX, SPF and DMARC lookup.
How to find the headers
- Gmail (web): open the message, click the three dots next to Reply, then Show original. Gmail shows the SPF, DKIM and DMARC results at the top.
- Outlook (web or new Outlook): open the message, click the three dots, then View → View message details.
- Apple Mail (Mac): select the message, then View → Message → All Headers.
- Saved .eml file: open it with the .eml viewer to read the message safely, or paste its headers into the analyzer.
If you think it's a scam
- Don't click links, open attachments or reply.
- Contact the company directly using its official website or the number on your card or statement.
- Use your email app's Report phishing or Report spam button. It helps protect other people.
- In the US, you can forward phishing emails to the Anti-Phishing Working Group at
reportphishing@apwg.organd report scams to the FTC at ReportFraud.ftc.gov. - If you already entered a password, change it right away, and turn on two-step verification for that account.
Questions people ask
How can I tell if an email is legit?
Check the real sender address behind the display name, hover over links to see where they go, and look for SPF, DKIM and DMARC "pass" in the headers on a domain spelled exactly right. Be suspicious of urgency, payment requests and login links.
Can a scam email pass SPF and DKIM?
Yes. Scammers can set up SPF and DKIM on lookalike domains they own. A pass proves which domain sent the message, so you still need to read that domain carefully.
Is an email from a gmail.com address from a company legit?
Usually not. Banks, payment services and large companies send from their own domains. A message claiming to be from them but sent from a free Gmail, Outlook or Yahoo address is a strong warning sign.
How do I check if an email address is real?
That is a different question from whether a message is a scam. Run the address through an email verifier, which checks the format, typos and whether the domain can receive mail.
Is it safe to open a suspicious email?
Opening and reading the message in a modern email app is generally low risk. The danger is clicking links, opening attachments, loading remote images in some cases, and replying with information.