Why the From line is not enough

The name and address you see in the From line are typed by the sender and can say anything. The headers hidden behind them record which servers handled the message and whether the receiving service could verify the sending domain. Google's help page puts it simply: the full header tells you where an email came from (Google).

Where to find the headers

Email app	Steps	Source
Gmail on a computer	Open the email; next to Reply, click More, then Show original; then Copy to clipboard	Google
New Outlook	More actions at the top of the message, then View > View message details	Microsoft
Classic Outlook for Windows	Open the email, File, Properties, then the Internet headers box	Microsoft's page has a tab for it; we could not read that tab on 26 October 2026
Apple Mail on a Mac	View, Message, All Headers	From the app's menu; Apple's guide page did not load for us on 26 October 2026

On a phone, most mail apps do not show headers; open the same mailbox on a computer or in a browser.

Paste what you copied into the checker above. It reads the text in your browser; nothing is sent.

The three checks

Check	Question it answers	What "fail" usually means
SPF	Was this server allowed to send for the domain?	Sent from a server the domain did not authorise
DKIM	Is the domain's signature intact?	The message was changed, or never signed by that domain
DMARC	Does the domain in the From line line up with SPF or DKIM?	The visible sender's domain was borrowed

Large mail services such as Gmail and Outlook usually write these results into an Authentication-Results line, which is what the checker reads. "pass" on all three means the email really came from that domain.

What passing does not prove

That the domain belongs to the company you think. A scammer can register "support-yourbank.example", set up all three records and pass every check. After the checks, read the domain itself the way you would read a link, including the endings for shared hosting.

The Reply-To trap

If Reply-To points to a different domain from the sender, your answer goes to someone else. It is a common trick in invoice and "boss needs a favour" emails, because the message itself can pass every check while the conversation moves to the scammer. The checker flags it in red.

When something is off

Do not reply and do not use the links. Contact the person or company through details you already have (FTC), then report the email.