Skip to content
We Sort.

Checking a suspicious email in Gmail

Some emails just feel off. An unexpected invoice, a supplier saying their bank details have changed, a login warning from a company you barely use.

Gmail can show you whether a message passed three checks that confirm it came from the domain it claims to. It takes a few seconds and needs no technical knowledge.

Below is where to find those checks, how to read them, and what they can and can’t tell you.

Related

Quick check

Click the small arrow under the sender's name and look at mailed-by and signed-by. Both should be the sender's real domain.

Gmail interface for mailed-by and signed by domains.

From Gmail phone app

Open the message > Click the ⌄ > Click “See security details” 

Gmail mobile app with link to see security details.
Gmail mobile app showing security details of a message.

Show original message

Gmail web app let’s us view the ‘raw’ message that was received along with some info about it. 

Open the message, click the three dots (⋮) at the top right, then Show original.

Gmail menu with the show original option.
Gmail interface for displaying an original email with pass for SPF DKIM and DMARC.

The summary table at the top is the useful bit.

  1. Look at the three results. SPF, DKIM and DMARC all showing PASS is the healthy picture.

  2. Check the domains match the From address. In the example above, DKIM passed for wesort.co.uk and the email is from ben@wesort.co.uk. That match is what matters. Be wary of an email "from PayPal" where DKIM passed for random-mailer.xyz.

  3. Check the From address itself. Lookalike domains such as paypa1.com, wesort-co.uk or wesort.co.uk.billing.net will pass every check, because the scammer owns that domain and has set it up properly.

  4. A DMARC fail on a big name (your bank, HMRC, Microsoft, a supplier) is a strong red flag. Don't click anything in it.

Two things to keep in mind

A pass doesn't mean it's safe. It only proves the email really came from the domain shown. If that domain is a lookalike, or a genuine account that has been hacked, everything passes. Hacked supplier accounts sending "our bank details have changed" invoices are common. For any change to payment details, phone the sender on a number you already have.

A fail doesn't always mean it's fake. Forwarded emails, mailing lists and badly configured small business email can all fail legitimately. Treat a fail as a reason to slow down, not as proof.