How to spot a fake email address
A suspicious email address is best evaluated by reading the real domain after the @ sign, comparing it with the organization you expected, and then checking supporting signals such as domain age, mail records and authentication policy. No single spelling trick, DNS record or risk score proves that an address is fake.
- Focus on the domain after @, not the display name shown by the mail app.
- Small spelling changes and digit substitutions can create convincing brand lookalikes.
- A recently registered domain is more meaningful when combined with other suspicious context.
- A valid MX record only shows that the domain is configured to receive mail; it does not verify the sender’s identity.
Start with the part after the @ sign
Mail apps often emphasize a friendly display name such as “PayPal Support” or “Microsoft Security”. Display names are not unique and can be chosen by the sender. The domain after the @ sign is therefore a more useful starting point for checking who the address claims to represent.
More detail
Compare that domain with the official domain you independently know or find through the organization’s official website. Do not assume affiliation because a brand name appears somewhere inside a longer domain.
Look for character substitutions and added words
Impersonation domains can replace letters with digits, insert or remove characters, or append words such as secure, verification, billing, account or support. A domain such as a misspelled brand followed by “-security” can look plausible at a glance while belonging to an unrelated registrant.
More detail
Can I Share This? uses conservative visual-normalization and edit-distance heuristics for a limited set of recognizable brands. The purpose is to surface a warning for manual verification, not to label every similar name as malicious.
Check whether the domain is unusually new
Fraud campaigns can use newly registered domains because the operator only needs the infrastructure for a short period. The same fact also applies to legitimate new organizations, so registration age should never be used as a standalone verdict.
More detail
Public RDAP services can expose registration events for many domains. When a usable registration date is available, the checker turns that into an approximate age and gives very recent domains more weight only as part of a multi-signal assessment.
Mail records are context, not identity
MX records indicate where a domain receives mail. SPF describes which systems are authorized for certain SMTP identities. DMARC describes alignment and handling policy. These technologies make spoofing harder when properly deployed, but they do not prove that the person behind a particular mailbox is legitimate.
More detail
A scammer can register a new domain and configure MX, SPF and DMARC correctly. Conversely, a legitimate small organization can have imperfect mail authentication. Treat these records as evidence about the domain’s setup, not a background check on the sender.
When to stop and verify another way
Independent verification becomes especially important when an unexpected email asks for money, credentials, recovery codes, identity documents, cryptocurrency, gift cards or urgent account action.
More detail
Open the official app or site yourself, use a phone number you obtained independently, or contact the person through a channel you already trust. Do not use contact details supplied only inside the suspicious message.
Primary references
These references define or document the email and domain-security concepts discussed above.
Related email and link safety pages
Check a suspicious email address
Paste the address into the same Can I Share This? scanner used for suspicious links. The checker automatically detects that the input is an email address.