Is this email genuine?

A message that says it’s from your bank, a delivery firm or your own IT team asks you to sign in, pay or open an attachment. Before you do any of that, these tools show where it really came from and where its links really go. They run in your browser, so the message isn’t uploaded anywhere.

1. Open it without your mail app

Save the message as a file and open it in the Email File Viewer. Apple Mail, Thunderbird and Outlook for Mac save an .eml when you drag the message to the desktop; Gmail and Outlook on the web have Download message in the message’s ⋮ or … menu, as does the new Outlook for Windows. Classic Outlook for Windows saves a .msg file when you drag the message to a folder, and the viewer reads those too. Pictures from the web aren’t loaded, so the sender can’t tell you opened it, and scripts and forms are switched off. You see the message, its attachments and every link, with any link whose text shows one site while it goes to another marked in red.

2. Read the headers

Copy the headers from the viewer (or from your mail app: in Gmail, Show original) into the Email Header Analyser. It lists what’s worth a look first:

• SPF, DKIM and DMARC: whether your own mail provider could prove the sender was genuine. A message “from” your bank that fails DMARC almost certainly isn’t from your bank.
• Reply-To: replies going to a different domain from the sender’s, a common trick for collecting answers.
• The route: each server the message passed through, with the delay at each step. Only the lines your own provider added can be trusted; everything below them is only a claim.

3. See where the links go

Paste a link into the URL Inspector. Unwrap takes off Outlook Safe Links, Proofpoint and the usual redirects to show the real address, and the parts and parameters are laid out so you can read the host properly. If you’re reporting the message, Defang turns the links into hxxps://evil[.]example so nobody clicks them by accident.

Then paste the address, or the sender’s domain, into Lookalike Characters. A Cyrillic а in pаypal.com looks right but isn’t, and the tool shows the xn-- address the browser would actually visit.

4. Check the attachments

Save an attachment from the viewer without opening it, then choose it in File Type. It reads what the file really is from its contents, so a program renamed invoice.pdf shows Name matches: No. A file that is what it says can still be harmful, so if you didn’t expect it, don’t open it.

5. If it’s your own domain being forged

When people tell you they’ve had fake mail from your address, paste your domain’s SPF and DMARC records into the SPF, DKIM & DMARC Checker. A DMARC policy of p=none only asks for reports; quarantine or reject tells receivers to stop forged mail. The tool also gives the dig commands to look the records up.