How to Tell If an Email Is Fake: Phishing, Spoofing, and Address Checks

“Fake email” can mean two different things: an invalid or disposable address, or a message pretending to come from a trusted person or organization. Those problems require different checks.

Fake Sender vs. Invalid Email Address

An invalid address is a mailbox or domain that cannot reliably receive mail. A spoofed or phishing message can come from a technically valid mailbox while misrepresenting who sent it or where its links lead.

Email verification helps with address validity. It does not prove that a message is trustworthy.

1. Inspect the Full Sender Address

Do not rely on the display name. Compare the actual domain with the organization's known domain and look for substitutions, extra words, unusual subdomains, or lookalike characters.

2. Check the Reply-To Address

A message can display one From address while directing replies somewhere else. A mismatched Reply-To is not automatically malicious, but it deserves explanation when the message asks for sensitive action.

3. Inspect Links Before Clicking

Check the destination domain rather than the visible anchor text. Unexpected URL shorteners, unrelated domains, or lookalike login pages are stronger warning signs than grammar mistakes alone.

4. Review Authentication Results

Message headers can show SPF, DKIM, and DMARC results. Authentication failures or misalignment can indicate spoofing, but a passing result does not guarantee the sender's intent is legitimate.

For the authentication layer, see SPF, DKIM, and DMARC for email deliverability.

5. Treat Requests for Credentials or Money Carefully

Unexpected password resets, payment changes, wire requests, gift-card requests, or urgent login prompts should be verified through a known independent channel rather than by replying to the message.

6. Be Cautious With Attachments

Do not open an unexpected attachment merely to determine whether a message is legitimate. Confirm the sender through a known contact path first.

7. Verify the Address Separately When Needed

If the question is whether the mailbox itself appears usable, use the Free Email Checker. That result should not be interpreted as proof that the person or brand shown in the message actually sent it.

If the sender claims to represent a business and you want to check whether public professional evidence supports that identity, follow the business-email identity research workflow.

What Email Verification Can Tell You

• whether the format is valid;
• whether the domain has usable mail infrastructure;
• whether available mail-server signals support the mailbox;
• whether the address has disposable, role, catch-all, or other risk signals.

What Verification Cannot Tell You

• whether a message is phishing;
• whether the sender's story is true;
• whether a link is safe;
• whether the displayed identity owns the mailbox;
• whether it is safe to send money or credentials.

Common Mistakes

• assuming a message in the spam folder is automatically fake;
• assuming polished grammar means a message is legitimate;
• replying to suspicious mail to “test” the sender;
• using mailbox verification as identity verification;
• trusting the display name instead of the actual sender and link domains.

Frequently Asked Questions

Can someone spoof a real email address?

Yes. Email authentication standards help receiving systems detect unauthorized use, but the visible From field alone is not proof of identity.

Does a Valid verification result mean the message is safe?

No. It means available technical signals support the mailbox. A valid mailbox can still be used for fraud or phishing.

What should I do with a suspicious business email?

Verify the request through the organization's official website, a known phone number, or an established contact channel rather than using details supplied only inside the suspicious message.

Bottom Line

Separate mailbox validity from message authenticity. Check the sender and link domains, authentication results, request context, and independent contact channels. Use email verification only for the technical address question.