How to check if an email is phishing
A convincing phishing email is easy to write. The logo is right, the wording is right, the sender name is right. What attackers cannot fake cheaply is time: the domain behind the message, or behind its links, usually did not exist a month ago.
Get the raw message first
What you see in a mail client is a rendering. The evidence lives in the raw message, headers included, which every mail client can export as a .eml file:
- Gmail: open the message, three-dot menu, Download message.
- Outlook on the web: three-dot menu, Save as.
- Outlook desktop: drag the message out of the list into a folder.
- Apple Mail: drag the message onto the desktop.
Forwarding the message to yourself is not the same thing. Forwarding rewrites the headers, so the original sender trail is lost and what you check is your own mail server rather than the attacker's.
Read the sender, then read the links
A message has more than one sender. The From address is the one you see. The Return-Path is where bounces go. Reply-To is where your answer goes, and it is frequently somewhere else entirely. The DKIM signature names the domain that actually signed the message. On legitimate mail these usually agree, or disagree in a boring way. On phishing they often point at three unrelated places.
Then read the links. Every link in the body has a domain, and that domain has a registration date. A brand-new domain behind a link in an email about your money is the single most useful thing on the page.
What a young domain does and does not prove
Phishing infrastructure is disposable. A domain gets registered, used for days or weeks, and abandoned once it is blocked, which is why anything registered under a year ago is worth reading first. It is a filter that takes a long list down to the two or three names deserving a human minute.
It is not proof. Every legitimate business was new once, and a real company launching a campaign will have a young domain. Read a young domain as look here first, not as this is an attack.
The reverse matters more, and catches people out. An old domain is not a clean bill of health. A great deal of phishing is sent through legitimate bulk-mail providers on domains registered a decade ago, using a compromised or throwaway account. Those messages pass SPF, DKIM and DMARC honestly, because they really were sent by the infrastructure they claim. When that happens, the old sender domain tells you nothing and the young link domain tells you everything.
What to do with what you find
If a link domain is young and the page it serves is a login form wearing someone's brand, you have a phishing page rather than a suspicion. From there the useful next step is a takedown request to the registrar and to the hosting network, which is a separate job with its own addresses and its own etiquette.
Do not log in to check. Do not reply to ask. If you think the message might be genuine, reach the organisation through an address you already had.
Questions
How do I save an email as a .eml file?
In Gmail, open the message, use the three-dot menu and choose Download message. In Outlook on the web, the three-dot menu has Save as, and the desktop app can drag a message straight to a folder. In Apple Mail, drag the message from the list onto your desktop. All of them produce a .eml, which is the raw message including its headers.
Does my email get uploaded anywhere?
No. The file is read and parsed in your browser. Only the list of domain names it found is sent for checking. The message body, the subject, your own address and the links themselves never leave your machine, and attachments are skipped without being read.
The sender domain is old. Does that mean the email is safe?
No. Plenty of phishing is sent through legitimate, long-established mail providers, and a compromised account on a twenty-year-old domain will pass every sender check there is. Age is a filter, not a verdict. Read the link domains as well, because that is where the money usually goes.
The email passed SPF, DKIM and DMARC. Is it genuine?
Not necessarily. Those checks prove the message really was sent by the domain it claims, not that the domain is honest or uncompromised. Phishing sent through a hijacked marketing account passes all three, because from the mail system's point of view it is perfectly authentic.
Check a suspicious email →Drop in the .eml and see every domain it contains, sender and links. Read in your browser, never uploaded. Free, no account.