Is This a Legit Email? A 7-Step Checklist

Is this a legit email? Use our 7-step checklist to verify the sender address, links, Gmail and Outlook authentication details and domain age before you act.

Quick answer: To tell whether an email is legit, check the full sender address and domain, see where replies and links really go, look at the authentication details your email app shows, and confirm any request through an official channel you find yourself. If the domain is new, misspelled or unrelated to the company, treat the message as suspicious.

Asking "is this a legit email?" is the right instinct. The checklist below takes a few minutes and works in Gmail, Outlook and most other email apps. For the full list of warning signs with annotated examples, see our guide on how to spot a phishing email.

Is this a legit email? The 7-step checklist

1. Verify the full sender address and domain

The display name is just a label that anyone can set. Click or tap the sender's name to see the full address, then read the domain after the @ carefully, from right to left. Ask yourself:

• Is it the organisation's real domain, the same one you see on its official website?
• Is it a free webmail address for a message that should come from a company?
• Is there an extra word, a hyphen or a swapped character, as in examp1e.com or example-billing.com?
• Is the real brand only a subdomain, as in example.com.secure-login.example, which actually belongs to secure-login.example?

This also answers the question "is this a legit email address?": an address is only as trustworthy as its domain. Common lookalike tricks are explained in typosquatting and homoglyph domains.

2. Check the reply-to address

Click Reply without sending and look at the address that appears in the To field. If it differs from the sender, especially if it switches to a free webmail account or an unrelated domain, someone wants your answer to go somewhere else. Invoice and payroll fraud often depends on this trick.

3. Hover over links before clicking

On a computer, hover over each link and read the destination shown at the bottom of the window. On a phone, press and hold the link to preview it. The destination should be on the organisation's real domain. Watch for shortened links, raw IP addresses and long addresses where the brand name appears only in the middle. Google recommends this check in its own Gmail phishing guidance (Google).

4. Check the authentication results

Email apps can show whether a message passed the technical checks known as SPF, DKIM and DMARC, which help confirm it really came from the domain it claims. Here is where to find them.

Gmail on a computer: open the email and click the down arrow below the sender's name. An authenticated message shows "mailed-by" and "signed-by" lines with the sending domain. A question mark next to the sender's name means Gmail could not authenticate it (Google). For more detail, click More (the three dots) next to Reply and choose Show original, which displays the full headers along with the SPF, DKIM and DMARC results (Google).

Gmail on Android: open the email, tap View details, then View security details (Google).

Outlook: Outlook does not use "mailed-by" or "signed-by" labels. Instead, it shows a question mark in the sender's photo when it can't verify the sender through email authentication, and an underlined "via" tag when the actual sender differs from the From address (Microsoft). To see the headers in new Outlook or Outlook on the web, open the message and choose More actions, then View, then View message details. In classic Outlook for Windows, open the message in its own window, choose File, then Properties, and read the Internet headers box (Microsoft). Search the headers for Authentication-Results and check for spf=pass, dkim=pass and dmarc=pass.

Two cautions. First, both Google and Microsoft note that not every unauthenticated message is malicious; some legitimate senders, such as mailing lists, fail these checks. Second, a pass only proves that the message came from the domain shown. A scammer who owns a lookalike domain can pass every check. Our SPF, DKIM and DMARC guide explains why.

5. Check whether the domain is newly registered

Phishing domains are often registered shortly before an attack. You can check a domain's registration date for free with ICANN Lookup, which retrieves registration data through RDAP, the successor to WHOIS, directly from registries and registrars (ICANN). Enter only the domain, such as example.com, and look at the creation or registration date. A bank or retailer that has operated for years would not normally email you from a domain registered last week. Owner details are often redacted for privacy, which on its own is normal, and some country-code domains show less information.

6. Contact the company through a channel you find yourself

This is the most reliable step of all. Open the company's app, type its web address yourself, or call the number on your card, statement or a previous bill. Never use the phone number, link or "support" contact in the suspicious email. If the request is genuine, the company's own channels will confirm it. For a colleague or supplier, call a number you already have on file.

7. Weigh the request itself

Even a technically perfect email can be fraudulent if it comes from a compromised account. Ask what the message wants you to do. Logging in through a link, sharing a one-time code, paying an unexpected invoice, changing bank details or buying gift cards all deserve independent verification, whoever appears to have sent the message. Tailored requests like these are typical of spear phishing.

Red flags that an email is probably not legit

• The domain is misspelled, has extra words or is a free webmail account.
• The reply-to address goes somewhere different from the sender.
• Links lead to a domain unrelated to the organisation.
• Gmail or Outlook shows a question mark for a well-known company that normally authenticates its mail.
• The sending or linked domain was registered very recently.
• You are pressured to act within hours, or threatened with closure, fines or legal action.
• You are asked for a password, verification code, card number or an unusual payment method.
• Bank details have "changed" without warning.
• An unexpected attachment asks you to enable content or enter a password.

What to do next

If the email passes every check and you confirmed the request through an official channel, you can act on it, ideally through the company's app or website rather than the links in the email.

If anything fails:

1. Don't click, reply, download or scan anything in the message.
2. Report it. In Gmail, click More and choose Report phishing; in Outlook, choose Report, then Report phishing. Our guide on how to report phishing in Outlook covers each version. At work, use your organisation's report button.
3. In the US, you can also forward phishing emails to reportphishing@apwg.org (FTC); in the UK, forward them to report@phishing.gov.uk (GOV.UK).
4. If you already clicked and entered details, change the affected password through the official site, turn on multi-factor authentication and contact your bank if payment details were involved.

If the email links to a fake login page that imitates a company, you can report a phishing site to us. And if you manage a brand that scammers keep imitating, book a free exposure scan to see which lookalike domains and cloned pages are live.

FAQ

How can I tell if an email address is legit?

Look at the full address, not the display name, and compare the domain after the @ with the organisation's official website. Misspellings, extra words, free webmail accounts and recently registered domains all suggest the address is not legitimate.

Does "mailed-by" or "signed-by" in Gmail mean an email is safe?

No. Those lines show which domain sent and signed the message. That is reassuring only if the domain is the organisation's real one, because scammers can authenticate their own lookalike domains.

Where do I see sender authentication in Outlook?

Outlook flags unverified senders with a question mark in the sender photo and shows a "via" tag when the real sender differs. For full results, open the message details or internet headers and find the Authentication-Results line.

Is an email from a real company address always legit?

Not always. A genuine mailbox can be compromised and used to send fraudulent requests. Verify unusual requests for logins, codes or payments through a channel you already trust.

Can I check whether a link is safe without clicking it?

Yes. Hover or long-press to read the destination, then paste the address into Google's Safe Browsing site status tool. A clean result is not a guarantee, since new phishing sites may not be flagged yet. Our guide is this a scam? covers more checks.