You get an email claiming to be from your bank, a platform you use, or a vendor, and something feels off. Is it real or is it phishing? Just looking at the sender’s display name isn’t enough — that’s exactly where scammers put their biggest effort. This guide teaches you to read the signals that actually tell a trustworthy email apart from a fraudulent one: the domain, its age, technical authentication, and the address’s public trail. These are the same signals an OSINT engine analyzes, explained so you can understand and use them yourself.
Why a «valid» email isn’t always a «trustworthy» email
First concept, and the most important one: technical validity isn’t the same as trust.
- An email can be technically valid (the address exists, the server accepts it) and still come from a scammer who created that account five minutes ago.
- The reverse is also true: a legitimate address can have a weak technical signal without being fraud.
Verifying an email, then, isn’t asking «does this address exist?» — it’s asking «can I trust whoever’s behind this message?» And that question is answered by several combined signals, not just one.
Signs that give away a fraudulent email
Recently created domain or typosquatting
The part after the @ is the domain, and it’s where most fraud hides:
- Typosquatting: domains that mimic a legitimate one with a tiny change that slips past a quick glance:
micr0soft.net(with a zero),bank-security-alert.com,amazon-shipping.info. At first glance they look real; read carefully, they’re not. - Recently registered domain. An «official» email arriving from a domain created days ago is a very strong fraud signal. We’ll cover how to check this below.
Disposable or temporary domain
There are use-and-throw email services that generate addresses that self-destruct within minutes. They’re legitimate for certain uses, but a supposedly serious contact (a vendor, a client, a bank) will never write to you from one. If the sender’s domain is one of these temporary services, trust drops to zero.
Missing SPF, DKIM or DMARC
These are the mechanisms that let you verify an email actually comes from who it claims to (explained in the next section). A domain that doesn’t have these protections configured is easier to spoof, and an email that fails these checks is suspicious.
A role address pretending to be personal
Addresses like no-reply@, admin@, info@ or security@ are role addresses (a function, not a person). They aren’t fraud on their own, but when an email signed by «John, your personal account manager» arrives from a generic no-reply@, there’s an inconsistency worth a closer look.
How to check an email’s authentication
Here’s the technical heart of it, explained simply. Three acronyms protect (or give away) an email: SPF, DKIM and DMARC. You don’t need to configure them; you need to understand what they tell you as a recipient.
| Mechanism | What it checks | What it means for you |
|---|---|---|
| SPF (Sender Policy Framework) | That the server that sent the email is authorized by the domain | If it fails, the email may have been sent from an unauthorized server: possible spoofing |
| DKIM (DomainKeys Identified Mail) | A digital signature guaranteeing the content wasn’t altered and comes from the domain | If it fails, the message may have been tampered with or forged |
| DMARC | The policy that ties SPF and DKIM together and says what to do if they fail | A domain with strict DMARC is much harder to spoof |
In short: an email from a serious organization usually passes SPF, DKIM and DMARC. An email that fails these, or comes from a domain that doesn’t even have them configured, deserves suspicion. Checking this by hand is tedious; that’s why it helps to analyze it with a tool that reads it all at once: you can analyze an email with technical context and an anti-fraud read.
Domain age and reputation
One of the best anti-fraud signals there is — and one of the least known — is the domain’s registration date. It’s looked up via RDAP (the public system that replaced WHOIS) and answers a devastating question: how long has the domain writing to me actually existed?
- A domain that’s years old, with SPF/DKIM/DMARC well configured and good reputation, fits a real organization.
- A domain that’s days or weeks old writing to you as if it were your long-time bank is, almost certainly, part of a fraud campaign set up for the occasion.
This age check is so powerful we also use it to detect fake stores: if you want the method applied to shopping, see how to detect a fake online store. And to analyze a domain on its own — age, public ownership, infrastructure and reputation — there’s domain analysis.
An email address’s public trail
An email address leaves a legitimate, aggregated public trail: which platforms it’s been used to sign up for, whether it’s associated with known services. This check is done in an aggregated, respectful way, without exposing sensitive personal data: it’s not about snooping into anyone’s life, but about seeing if an address’s usage profile fits what the email claims to be.
For example, an email claiming to be a well-established company’s finance department, but whose address has no trail consistent with that activity, is, at the very least, inconsistent. This is anti-fraud OSINT applied to email; the general framework is in what OSINT intelligence is.
Quick checklist before trusting an email
Before clicking a link, downloading an attachment, or replying with data, go through this:
- Is the domain (after the @) exactly the official one? Watch for swapped letters or added words.
- How long has that domain existed? A new domain presenting itself as long-established is a red flag.
- Does it pass authentication checks (SPF/DKIM/DMARC)?
- Is the address consistent with who it claims to be (not disposable, not a generic role signing as a person)?
- Does the message rush you or ask for data/credentials? Urgency and requests for passwords are phishing’s signature.
- When in doubt, don’t use the link in the email. Go to the official website yourself by typing the address.
Analysis with technical context and an anti-fraud read
Doing all these checks by hand takes time and know-how. An OSINT platform brings them together in a single read: validates the email, checks the domain and its age, verifies authentication, assesses reputation and public trail, scores the risk, and explains it in plain language. You can analyze an email with technical context and an anti-fraud read and get an exportable report with dated evidence via an RFC 3161 timestamp, useful if you need to keep proof of a fraud attempt.
Frequently asked questions about fraudulent emails
Look at the domain (not just the name): if it’s imitated with a small change, is recently registered, fails authentication, or the message urgently asks for credentials, be suspicious. No single signal decides it; the combination does.
Mechanisms that let a recipient verify an email really comes from the domain it claims to. If an email fails them, it’s more likely to be spoofed.
Barely. The visible name is easily faked. What’s reliable is the domain after the @ and its technical signals.
Yes. An address existing and working doesn’t mean whoever uses it can be trusted. Technical validity and trust are different things.