Mail servers
Look for MX records showing whether the domain is configured to receive email.
Home / Is this email address safe?
Sender-address safety
Email Safety Checker
Why this deserves a check
Display names are easy to imitate, and a familiar-looking address can use a subtly different domain. Domain-level signals help explain whether a sender address has normal mail infrastructure and whether the domain is unusually new or resembles a known brand.
SPF and DMARC are useful authentication signals, but their presence does not prove that a specific message or sender is legitimate. Treat them as part of the evidence, not a green light.
What Can I Share This? checks
SPF & DMARC
Report published sender-authentication policies and important policy context.
Domain age
Use RDAP registration data when available as a contextual signal.
Lookalike patterns
Check for domain spellings that may imitate a recognizable brand.
Example scanner output
This documented regression fixture shows the same classifications used by the Universal Safety Checker.
- Detected type
- Email address
- Domain
- paypai.example
- Lookalike signal
- PayPal
- Safety state
- Context warning
The reserved .example address exercises the lookalike detector without checking a real person's mailbox.
What the result cannot prove
No scanner can guarantee that a link, sender or website is safe. A result can report known threats and warning signals, but it cannot prove identity, business legitimacy, licensing, product quality or future behavior. For sensitive actions, verify the organization independently.
Safer next steps
- Do not use the display name as proof of identity.
- Compare the full domain after the @ symbol with the organization’s official domain.
- Verify requests for money, credentials or documents using a saved phone number or official website.
- Inspect message headers when you need evidence about the actual delivery path and authentication results.
Frequently asked questions
Can SPF and DMARC prove an email is legitimate?
No. They help authenticate permitted sending infrastructure and domain policy, but a legitimate domain can still send an unwanted message or have a compromised account.
What does a very new email domain mean?
It is a reason for extra verification, not proof of fraud. Many legitimate organizations also use recently registered domains.
Can the checker tell whether a mailbox exists?
Not reliably without interacting with the mail provider, which can be inaccurate and privacy-invasive. The checker focuses on domain-level signals.
Does the email checker send my address to Google Web Risk?
No. The email path uses email and domain checks rather than sending the email address to the URL threat-list service.
Related safety guides
Primary references
Check it before you trust it
Paste the suspicious link or email address into the same checker. You will get the destination, available threat signals and a plain-language recommendation without a signup.
Check a link or emailLast reviewed: 2026-09-03 · Can I Share This? safety content
What the email safety checker actually checks
Address format
Checks whether the submitted address has a supported, plausible email structure.
Domain existence
Looks for DNS evidence that the domain exists and can receive or publish email-related records.
MX records
Checks whether the domain publishes mail-exchanger records when DNS data is available.
SPF and DMARC
Inspects published sender-authentication policy signals. Missing or weak policy is context, not proof of fraud.
Lookalike domains
Flags domains that visually resemble selected well-known brands but are not recognized official domains.
Disposable domains
Identifies a maintained set of known temporary-email providers as a contextual warning signal.
Domain age context
Uses public RDAP registration data when available. A new domain can deserve more scrutiny but is not automatically malicious.
Internationalized domains
Highlights punycode or internationalized-domain encodings that can sometimes make visual impersonation harder to notice.
What this checker cannot prove
It cannot prove who controls a mailbox, guarantee that a sender is legitimate, or authenticate the exact message from an address alone. Display-name spoofing and message-level social engineering require the full message context.
For a suspicious email, verify the company through a website or app you already trust rather than using the contact details or links inside the message.
Phishing reference: U.S. Federal Trade Commission — How to recognize and avoid phishing scams.