How to Check if an Email Is Really From a Company (5 Checks)

Scam emails often look exactly like the real thing: the right logo, the right colours, even a sender name like “Your Bank Support”. Phishing and spoofing was the most reported crime type to the FBI’s Internet Crime Complaint Center in 2025, with 191,561 complaints, and business email compromise, where scammers pose as suppliers or bosses, cost US$3.05 billion in reported losses (FBI IC3 2025). These five checks take a couple of minutes and work for personal and business email.

1. Read the real sender address, not the name

The name you see (“PayPal”, “Australia Post”, “Accounts Team”) can be set to anything. What matters is the address behind it. On a computer, hover over or click the sender name. On a phone, tap the name. If “Your Bank” is really alerts.yourbank@gmail.com or support@random-site.xyz, it isn’t your bank.

2. Check the domain for lookalikes

The domain is the part after the @. Compare it letter by letter with the company’s real website address (type that yourself, don’t click the email). Watch for:

Missing, doubled or swapped letters: exmple.com, exammple.com.
Look-alike characters: rn instead of m, the number 1 instead of l.
A different ending: .co or .net instead of .com.
Extra words: example-billing.com, example-support.net.
The real name in the wrong place. Read the domain from right to left from the last dot: example.com.secure-login.net belongs to secure-login.net, not example.com.

Our guide to lookalike domain examples has more patterns. Also check the Reply-To address (it shows when you press Reply): if it’s different from the sender, your answer goes to someone else. And before clicking any link, hover over it (or press and hold on a phone) to see where it really goes.

3. Check SPF, DKIM and DMARC in the headers

Every email carries hidden “headers” that record how it was sent. Three of them tell you whether the sending domain vouched for it:

SPF checks the email came from a server the domain allows to send for it.
DKIM checks a digital signature the domain added to the message.
DMARC checks that SPF or DKIM passed for the same domain shown in the From line. This is the one that matters most. See what is DMARC.

In Gmail (on a computer): open the email, click the three dots next to Reply, and choose Show original. The full header opens in a new window (Gmail Help). At the top you’ll see lines for SPF, DKIM and DMARC, each marked PASS or FAIL. You can also paste the header into Google’s free Messageheader tool for a readable summary.

In Outlook (desktop): open the email and go to File, then Properties, and look in the “Internet headers” box (Gmail Help). Search the text for Authentication-Results and look for spf=pass, dkim=pass and dmarc=pass. In Apple Mail, choose View, Message, All Headers.

How to read the result:

DMARC fail, or SPF and DKIM both fail: treat it as fake. Someone is very likely spoofing the company.
All pass, and the domain is the company’s real one: the email genuinely came from that domain. It can still be a scam if the company’s mailbox was hacked, so be careful with payment or login requests.
All pass, but the domain is a lookalike: it’s a scam. Scammers can set up SPF, DKIM and DMARC on their own fake domains, which is why step 2 matters.

4. Verify another way

If an email asks you to log in, pay, update card or bank details or confirm personal information, don’t use its links, phone numbers or attachments. The FTC’s advice: contact the company using a phone number or website you know is real (FTC). For businesses, always confirm new bank details by phone on a number from your own records; see how to spot a fake invoice email.

5. Report it, then delete it

Everyone: use your email app’s “Report phishing” or “Report junk” option.
United States: forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and report to ReportFraud.ftc.gov (FTC).
United Kingdom: forward suspicious emails to report@phishing.gov.uk (NCSC).
Australia: report to Scamwatch. New Zealand: report to Netsafe.

If you already clicked or replied

Change the password for the account involved (and anywhere you reused it), turn on two-factor authentication, and run a security scan. If you shared card or bank details, call your bank straight away. In the US, IdentityTheft.gov lists steps based on what you shared (FTC). If your details may have leaked, read has my email been in a data breach?

Run a business? Stop scammers using your name

If customers could get fake emails “from” you, check your own domain with our free domain scan. It reads your SPF, DKIM, DMARC and MX records and checks about 50 lookalike variants of your domain. Then follow how to stop someone spoofing your email domain.

Protect your personal email

Our Personal plan (US$9/month) watches up to three personal email addresses for new data breaches and dark web leaks, and includes one AI-powered romance scam check a month, the ability to report fake profiles, and account recovery help.

Questions

If SPF, DKIM and DMARC all pass, is the email safe?

Not always. A pass only shows the email really came from the domain in the From line. Scammers can register a lookalike domain and set it up correctly, so it passes too. Check the domain itself is the company’s real one, and still be careful with links and payment requests.

What does it mean if DMARC fails?

The email claims to be from a domain but couldn’t prove it. That is a strong sign of spoofing, though occasionally a company’s own email setup is wrong. Don’t click links or pay anything; contact the company another way.

Can a scam email come from a company’s real address?

Yes, if the company’s mailbox has been hacked. Then all the checks can pass. That’s why any request to change bank details, pay urgently or log in through a link should be confirmed by phone on a number you already know.

Where do I see email headers on my phone?

The Gmail and Outlook mobile apps don’t show full headers. Open the email in a web browser on a computer, or forward it to yourself and check it there.

Check a domain, or get ongoing protection

Run our free domain scan to see a company’s SPF, DKIM and DMARC setup and live lookalike domains. ImposterWatch Personal (US$9/month) adds breach alerts for up to three personal email addresses, a monthly romance scam check and account recovery help.

Scan a domain free See the Personal plan

More guides

General information only, not legal or financial advice. ImposterWatch is operated by Cloud Investments FZE (UAE) and is not a background check or private investigator service.

How to check if an email is really from a company