How to spot a phishing email: the signs to check

To spot a phishing email, ignore the name it shows and check three things: the real address it came from, the real address its links open, and what it wants from you. A message that claims to be from a company you know, comes from a domain that is not that company's, and pushes you to sign in, pay or open a file is almost always a fake.

The signs, side by side

The sender address, not the name

The name shown beside an email is free text. Anyone can type "Apple Support" or your manager's name there. The address after it is harder to fake, and the part after the @ sign, the domain, is what matters.

Lookalike domains

A fake domain is built to pass a glance: a digit 1 for a lower-case L, "rn" for "m", two letters in the wrong order, a character from another alphabet, or the real brand used as one part of a longer domain. Read from the right: the last two parts are usually the real owner. In "yourbank.example-login.com" the owner is example-login.com, not your bank.

Where the link really goes

A link has two parts: the text you see and the address it opens. They do not have to match. Hover the pointer over a link, without pressing, and your mail app or browser shows the real address. If the text reads like one site's address and the link opens another, treat the message as hostile.

Links that pass through a tracking service also hide the destination, which is why honest marketing mail can look suspicious. The guide on blocking email tracking pixels explains what those are for.

Urgency and attachments

Phishing depends on you acting before you think. A deadline, a threat to close an account, a prize or a request from someone senior is there to hurry you. Honest companies rarely ask for a password, a card number or a sign-in code by email, and none will mind if you sign in on their own site instead.

What SPF, DKIM and DMARC results mean

These are three checks your mail provider runs when a message arrives. It writes the results into a hidden header called Authentication-Results, which many mail apps can show ("Show original" or "View source").

A pass only proves the mail came from the domain it claims: a criminal who registers a lookalike domain can pass all three. And a failure is not always fraud, because forwarding and mailing lists can break SPF or DKIM on honest mail.

What to do with a suspicious email

1. Do not press its links, open its attachments or reply.
2. If it might be real, type the company's address yourself and check your account there.
3. If it claims to be from someone you know, ask them by phone or in a new message.
4. Report it as spam, so your mail provider learns from it.
5. If you already entered a password, change it on the real site at once and turn on two-step sign-in.
6. If you entered card details, call your bank.

What Mailvie checks on your Mac

Mailvie, a mail app for the Mac, runs fixed rules on each message and shows a warning on the email when the signs add up. The rules use no AI and no lookup service: no sender, link or message is sent anywhere to be checked.

• It reads the SPF, DKIM and DMARC results your own mail provider recorded.
• It compares the sender's domain with a list of well-known brands that ships with the app, looking for near misses.
• It notices a name that says a brand when the address is not that brand's.
• It flags a link whose text is one web address and whose target is another site.
• A Reply-To on another domain and pressure wording in the subject count as weak signs, never enough alone.

The warning says what was found in plain words and offers Report spam, Block sender and Looks safe. It never moves or deletes mail by itself. Rules like these miss some phishing and can flag an honest message, so the habits above still matter. The warnings are free; blocking a sender needs a plan. You can download Mailvie for Mac and read the list of connections the app makes.

Questions people ask

Can a phishing email pass SPF, DKIM and DMARC?

Yes. Those checks prove that a message came from the domain it claims, not that the domain is honest. Someone who registers a lookalike domain can set up all three correctly, so always read the domain itself.

Is it dangerous just to open a phishing email?

Opening it is rarely the danger. The harm comes from pressing a link, opening an attachment or replying with information. Loading its images can tell the sender your address is in use.

What should I do if I pressed a link in a phishing email?

If you only opened the page, close it. If you typed a password, change it on the real site straight away and anywhere else you reused it. If you gave card details, call your bank.