Free tool · phishing check

Is this email really from them?

Paste the sender’s address. We check it against what Microsoft, Google, Apple, PayPal, Amazon and others publish about their own email — and catch look-alike domains like paypa1.com.

The checker needs JavaScript. You can still compare an address with the directory below.

Is the domain theirs?

The part after the @ must be a domain the company actually owns. Look-alikes swap letters (paypa1, rnicrosoft) or add words (paypal-security).

Did it pass DMARC?

Anyone can type any From address. DMARC — in the email’s headers — shows whether the domain really sent it.

Does it ask for something they never ask?

Passwords, codes, gift cards, payment by email. Each company below says what it will never ask for.

Official sender directory · checked October 2026

What each company publishes about its email

Only what each company says on its own help pages, with the source. Where a company doesn’t publish its sending addresses, we say so instead of guessing.

Microsoft

microsoft.com · microsoftonline.com · office.com · +7

Is this Microsoft email real? →

Sends from

account-security-noreply@accountprotection.microsoft.com Microsoft account security alerts, such as unusual sign-in activity

How to check

Type account.microsoft.com/security into your browser yourself, select Review activity, and look for the sign-in the email describes. If you don’t recognise it, choose This wasn’t me or Secure your account.
Outlook shows a “?” in place of the sender’s photo when it can’t verify who sent a message. Microsoft notes that not every message that fails this check is malicious, but a familiar sender suddenly showing “?” can be a sign of spoofing.

Report it

In Outlook.com, select the message, then Report → Report phishing.

Sources: Microsoft Support: What happens if there’s an unusual sign-in to your account · Microsoft Support: Phishing and suspicious behavior in Outlook

Google

google.com · youtube.com · withgoogle.com · +10

Is this Google email real? →

Sends from

@google.com Google Ads emails, in both the From address and the Return-Path
@ads.google.com Google Ads emails, in both the From address and the Return-Path

How to check

Google doesn’t publish the address its account security alerts come from. Check the alert by typing myaccount.google.com/notifications into your browser — it lists your account’s recent security activity.
Google’s advice: check that the sender name and address match, check whether the email is authenticated, and hover over links before clicking.

Never asks

Google says it doesn’t send unsolicited messages asking for your password or other sensitive information, by email or through a link.

Report it

In Gmail on a computer, open the message, click More next to Reply, then Report phishing.

Sources: Gmail Help: Avoid & report phishing emails · Google Account Help: “Suspicious sign in prevented” email · Google Ads Help: Suspicious emails or calls claiming to be from Google Ads

Apple

apple.com · itunes.com

Is this Apple email real? →

Sends from

Apple doesn’t publish its sending addresses. Use the checks on the right instead.

How to check

Apple doesn’t publish a list of its sending addresses. Its warning signs: the sender doesn’t match the company it claims to be, a link’s address doesn’t match Apple’s website, or the message asks for a card number or password.

Never asks

Apple says it never asks for your Apple Account password, device passcode or two-factor authentication code to provide support, never asks you to tap Accept on a two-factor prompt, and never asks you to turn off a security feature.
Apple says never to use Apple Gift Cards to make payments to other people.

Report it

Forward the email to reportphishing@apple.com. For a suspicious text, send a screenshot to the same address.
Entered your details on a fake page? Apple says to change your Apple Account password immediately and make sure two-factor authentication is on.

Source: Apple Support: Recognize and avoid social engineering schemes

PayPal

paypal.com · paypal.co.uk · paypal.de · +5

Is this PayPal email real? →

Sends from

PayPal doesn’t publish its sending addresses. Use the checks on the right instead.

How to check

PayPal emails address you by your first and last name, or by your business name — never “Dear user” or “Hello PayPal member”.
To check a notice, log in to PayPal yourself instead of using the email’s links.

Never asks

PayPal only asks for your password on its own login page, and never asks you to share a tracking number by email.

Report it

Forward the email to phishing@paypal.com, then delete it.

Sources: PayPal Help: How do I spot a fake, fraudulent, or phishing PayPal email or website? · PayPal: Phishing and spoof emails

Amazon

amazon.com · amazon.co.uk · amazon.de · +19

Is this Amazon email real? →

Sends from

@amazon.com Amazon says approved Amazon emails are sent from an amazon.com email address

How to check

Genuine messages also appear in Message Center in your Amazon account. Amazon says that if an email isn’t there, Amazon didn’t send it.
Common email providers show the Amazon smile logo next to emails that really come from Amazon.

Never asks

Amazon says it will never ask you to buy a gift card, never asks for payment by phone or email, and never asks you to install software or give remote access to your device.

Report it

Amazon customers: use Amazon’s Report a Scam page. Not a customer: email reportascam@amazon.com.

Sources: Amazon Customer Service: How to identify fake emails · About Amazon: How to avoid Amazon scams

Netflix

netflix.com

Is this Netflix email real? →

Sends from

Netflix doesn’t publish its sending addresses. Use the checks on the right instead.

How to check

Netflix doesn’t publish a list of sending addresses. Check your account by opening the Netflix app or typing netflix.com yourself.

Never asks

Netflix says it never asks for card numbers, bank details or your Netflix password in a text or email, and never asks for payment through a third-party vendor or website.

Report it

Forward the email to phishing@netflix.com.

Source: Netflix Help: Phishing or suspicious emails or texts claiming to be from Netflix

DocuSign

docusign.com · docusign.net

Is this DocuSign email real? →

Sends from

@docusign.com Signing emails
@docusign.net Signing emails

DocuSign says these are the only domains it sends from.

How to check

DocuSign says legitimate signing emails come only from @docusign.com or @docusign.net addresses — and gives dse@docusgn.com, with the “i” missing, as an example of a fake.

Report it

Forward the email to spam@docusign.com, then delete it. Don’t open its attachments.

Source: DocuSign Trust Center: Malicious email campaign alert (May 2017)

X (Twitter)

x.com · twitter.com

Is this X email real? →

Sends from

@x.com All email from X

X (Twitter) says these are the only domains it sends from.

How to check

X says it only sends email from @x.com.

Never asks

X says it never sends emails with attachments and never asks for your password by email, Direct Message or reply.

Source: X Help Center: About fake X emails

Dropbox

dropbox.com · dropboxmail.com · docsend.com · +11

Is this Dropbox email real? →

Sends from

@dropbox.com Support and service email (such as verification and password resets), business and promotional email
@dropboxmail.com Support, service and promotional email
@txn.dropbox.com Support, service and promotional email
@em-s.dropbox.com Support, service and promotional email
@em.dropbox.com Support, service and promotional email
@docsend.com Support, service and promotional email
@dropbox.zendesk.com Support email
@dropboxpartners.com Business-related email
@dropboxteam.com Promotional and tip email

Dropbox says these are the only domains it sends from.

How to check

Dropbox says its websites and emails only come from its verified domains, and publishes the full list.

Report it

Forward the full suspicious email to abuse@dropbox.com.

Sources: Dropbox Help: What official domains does Dropbox use? · Dropbox Help: How to protect yourself from phishing and viruses

Yahoo

yahoo.com

Is this Yahoo email real? →

Sends from

Yahoo doesn’t publish its sending addresses. Use the checks on the right instead.

How to check

In Yahoo Mail on the web, emails from Yahoo show a Yahoo icon next to the sender’s name. Hover over the name to see the real address without opening the message.

Never asks

Yahoo says it never asks for personal info, such as credit cards or passwords, in emails.

Source: Yahoo Help: Identify legitimate Yahoo websites, requests, and communications

HMRC (UK tax)

hmrc.gov.uk

Is this HMRC email real? →

Sends from

HMRC (UK tax) doesn’t publish its sending addresses. Use the checks on the right instead.

How to check

HMRC says you’ll never get an email, text, app message or call from it that tells you about a tax rebate or penalty, or that asks for your personal or payment information.

Report it

Forward suspicious HMRC emails to phishing@hmrc.gov.uk and texts to 60599.

Source: GOV.UK: Report HMRC phishing emails, texts and phone call scams

IRS (US tax)

irs.gov

Is this IRS email real? →

Sends from

IRS (US tax) doesn’t publish its sending addresses. Use the checks on the right instead.

How to check

The IRS says: “We never email without your permission.”

Report it

Send the email to phishing@irs.gov with the subject “IRS”. Forward scam texts to 7726 (SPAM).

Source: IRS: Report fake IRS, Treasury or tax-related emails and messages

Where else to report phishing

Besides the company being impersonated and your email app’s “Report phishing” button:

United States: Forward phishing emails to reportphishing@apwg.org and report the attempt to the FTC at ReportFraud.ftc.gov. Source: consumer.ftc.gov
United Kingdom: Forward suspicious emails to report@phishing.gov.uk, the Suspicious Email Reporting Service. Source: nicybersecuritycentre.gov.uk

Why the address alone isn’t proof

The From address is just text the sender types. Email was designed without a way to stop someone writing security@paypal.com on a message they send from anywhere. What stops it working is DMARC: the domain owner publishes a policy, and your provider checks that the message really came from that domain. The result is written into the email’s headers — paste them into the Email Header Analyzer to see it, and to get the same directory check on the real sender.

How look-alike domains fool people

Swapped characters: a digit 1 for an l (paypa1.com), “rn” for “m” (rnicrosoft.com), a zero for an o.
Letters from another alphabet: a Cyrillic “а” looks identical to a Latin “a”. Browsers often show these domains in a form starting xn--.
Extra words: paypal-security.com or amazon-billing.net contain the name but belong to someone else.
The name as a subdomain: in apple.com.verify-id.info, the real domain is verify-id.info — read a domain from the right.
A free mailbox with a trusted name: “Apple Support” <apple.support@gmail.com>. Anyone can create that.

Questions

How can I tell if an email is really from Microsoft, Google or PayPal?

Check three things: the domain after the @ belongs to the company (this checker does that), the email passed DMARC (paste its headers into our header analyzer), and it doesn’t ask for anything the company says it never asks for, such as your password or a gift card.

Is account-security-noreply@accountprotection.microsoft.com real?

Microsoft says its account security alerts come from that address. But a From address can be forged, so check the sign-in by typing account.microsoft.com/security into your browser yourself rather than using the email’s links.

Does Google publish the address its security alerts come from?

Not in the help pages we checked. Google’s advice is to check your recent security activity at myaccount.google.com/notifications.

If an address isn’t in the directory, is it fake?

No. We only list companies that publish details about their own email, and only what they publish. An unlisted address can be genuine — confirm by contacting the company through its website or app.

I clicked a link or entered my password. What now?

Change that account’s password straight away from the company’s own website or app, turn on two-step verification, and check the account’s recent activity. Each company’s card above links to its own advice.

Is anything I paste here stored?

No. The check runs entirely in your browser; the address is never sent to our server.

Sources

More free tools

Check something else

Email Signature Generator → A professional signature for Gmail and Outlook. Gmail Search Builder → Find any email by sender, date, size or attachment. Outlook Search Builder → Find any email in Outlook or Outlook.com. SPF, DKIM & DMARC Checker → Is the domain’s email authentication set up? MX Lookup → Which servers receive mail for a domain. SPF Record Generator → Build a valid SPF record for your domain. DMARC Record Generator → Create the DMARC policy to publish. DMARC Report Analyzer → See who sends as your domain, from your DMARC reports. Email Header Analyzer → Trace a message and check who really sent it. Email Settings Finder → IMAP, POP3 and SMTP settings for any address.