mailcheck.app

Free in-browser tool that checks whether an email is genuine — or a phishing attempt.

Is this email really from who it says ?

Drop in the email you want to check. We'll tell you whether it really came from the sender you see, or whether someone is impersonating them — in plain language, with the reasons why.

RUNS │ locally in browser KEEPS │ no account, no history COVERS │ SPF · DKIM · DMARC · +9

How do I find the email in my mailbox ?

Pick how you read your mail and which provider you use. We will walk through the four taps it takes to save the raw message and drop it back into the verifier.

Device
PROVIDER
01 / 02 Gmail

Open the message

In the Inbox list, click the message you want to check to open it.

Two answers, not one verdict.

One email, two independent checks: is it really from them — and is it a scam? They are not the same question.

Is it a scam?

Spot the trap before you click

Does this email look like a phishing or scam attempt?
Likely phishing

Multiple strong signals indicate this is likely a phishing or scam attempt.

  • Sending IP on a known blocklist
  • Domain registered 3 days ago
  • Reply-to points to a different domain

A message that pressures you, a login link, an invoice, or a sudden “we’ve changed our bank account”. Before you click, pay, or forward it to finance, check whether the sender is real and where the links actually lead.

Is it really them?

Prove it — beyond doubt

Does this email really come from the sender shown in the "From" field?
Sender verified

Sender identity cryptographically confirmed by the example.com server.

  • DKIM signature valid
  • SPF aligned with the sender domain
  • DMARC policy passed

You need to show — to a counterparty, an employer or a court — that a message really came from the stated sender and nobody altered it on the way. We verify the cryptographic signature (DKIM) that settles it.

Three steps to a verdict

Upload the email

Drop an .eml file or paste raw email source including all headers. Nothing is uploaded — the parser runs in your browser.

We analyse it

The tool fetches the sender's public keys and domain policies, recomputes the cryptographic signatures and runs heuristic checks on the headers.

You get the result

One of three verdicts — likely phishing, likely genuine, or inconclusive — with the underlying signals broken out so you can read why.

What we check

A dozen automatic checks run on every message. Each signal is reported separately — no single magic score. You can see whether the verdict rests on one strong cryptographic proof or a pile of softer red flags.

cryptography

DKIM Signature

The sending server attaches a cryptographic signature covering the email's headers and body. The tool fetches the matching public key and recomputes the signature — if anything was changed after sending, the check fails.

policy

SPF Policy

Every domain publishes a list of mail servers allowed to send on its behalf. The tool reads that list and compares it with the IP that actually delivered the message.

policy

DMARC Alignment

The domain's owner declares what should happen when checks fail — accept, quarantine, or reject. The tool reports the policy and checks whether the visible From address aligns with the authenticated domain.

heuristic

Sender Identity

Phishing emails routinely fake the visible display name — a message signed "PayPal Security" <random@somewhere.tld> reads as PayPal in most clients. The tool compares display name with the actual sending domain and flags mismatches.

heuristic

Lookalike Domains

Attackers register domains that look almost identical to a real one — paypa1.com, microsoft.com (with a Cyrillic o), bank-secure.com. The tool inspects the sender domain for character substitutions, added words and mixed alphabets.

reputation

IP Reputation

The server that delivered the message is checked against several public blocklists used by mail operators worldwide. Presence on those lists is a strong indicator the address has been used to send spam, phishing or malware.

heuristic

Domain Age

Brand-new domains are disproportionately used in scams — a domain registered three days before the message arrives is a red flag, especially when it imitates a well-known name. The tool reads the registration date from public domain registries (RDAP).

heuristic

Reply-To Mismatch

A message can declare a different address for replies than the one it was sent from. That is legitimate for newsletters and helpdesks, but in phishing it routinely redirects victims to a free webmail account controlled by the attacker.

heuristic

Link Inspection

Visible link text versus actual URL, redirect chains, link-shortener usage and IDN homograph attacks are all flagged. We never visit the links — only analyse them statically.

reputation

Sender network

We check whether any server in the message's delivery path belongs to a VPN provider or a Tor exit node. Legitimate mail rarely travels through anonymizing networks — in phishing it's a common way to hide the real origin.

authentication

BIMI

Brand Indicators for Message Identification — checks whether the sender's domain publishes a BIMI record with a logo, and validates any attached Mark Certificate (VMC). Displayed as a brand avatar in supporting mail clients.

cryptography

DKIM Signature

The sending server attaches a cryptographic signature covering the email's headers and body. The tool fetches the matching public key and recomputes the signature — if anything was changed after sending, the check fails.

policy

SPF Policy

Every domain publishes a list of mail servers allowed to send on its behalf. The tool reads that list and compares it with the IP that actually delivered the message.

policy

DMARC Alignment

The domain's owner declares what should happen when checks fail — accept, quarantine, or reject. The tool reports the policy and checks whether the visible From address aligns with the authenticated domain.

heuristic

Sender Identity

Phishing emails routinely fake the visible display name — a message signed "PayPal Security" <random@somewhere.tld> reads as PayPal in most clients. The tool compares display name with the actual sending domain and flags mismatches.

heuristic

Lookalike Domains

Attackers register domains that look almost identical to a real one — paypa1.com, microsoft.com (with a Cyrillic o), bank-secure.com. The tool inspects the sender domain for character substitutions, added words and mixed alphabets.

reputation

IP Reputation

The server that delivered the message is checked against several public blocklists used by mail operators worldwide. Presence on those lists is a strong indicator the address has been used to send spam, phishing or malware.

heuristic

Domain Age

Brand-new domains are disproportionately used in scams — a domain registered three days before the message arrives is a red flag, especially when it imitates a well-known name. The tool reads the registration date from public domain registries (RDAP).

heuristic

Reply-To Mismatch

A message can declare a different address for replies than the one it was sent from. That is legitimate for newsletters and helpdesks, but in phishing it routinely redirects victims to a free webmail account controlled by the attacker.

heuristic

Link Inspection

Visible link text versus actual URL, redirect chains, link-shortener usage and IDN homograph attacks are all flagged. We never visit the links — only analyse them statically.

reputation

Sender network

We check whether any server in the message's delivery path belongs to a VPN provider or a Tor exit node. Legitimate mail rarely travels through anonymizing networks — in phishing it's a common way to hide the real origin.

authentication

BIMI

Brand Indicators for Message Identification — checks whether the sender's domain publishes a BIMI record with a logo, and validates any attached Mark Certificate (VMC). Displayed as a brand avatar in supporting mail clients.

cryptography

DKIM Signature

The sending server attaches a cryptographic signature covering the email's headers and body. The tool fetches the matching public key and recomputes the signature — if anything was changed after sending, the check fails.

policy

SPF Policy

Every domain publishes a list of mail servers allowed to send on its behalf. The tool reads that list and compares it with the IP that actually delivered the message.

policy

DMARC Alignment

The domain's owner declares what should happen when checks fail — accept, quarantine, or reject. The tool reports the policy and checks whether the visible From address aligns with the authenticated domain.

heuristic

Sender Identity

Phishing emails routinely fake the visible display name — a message signed "PayPal Security" <random@somewhere.tld> reads as PayPal in most clients. The tool compares display name with the actual sending domain and flags mismatches.

heuristic

Lookalike Domains

Attackers register domains that look almost identical to a real one — paypa1.com, microsoft.com (with a Cyrillic o), bank-secure.com. The tool inspects the sender domain for character substitutions, added words and mixed alphabets.

reputation

IP Reputation

The server that delivered the message is checked against several public blocklists used by mail operators worldwide. Presence on those lists is a strong indicator the address has been used to send spam, phishing or malware.

heuristic

Domain Age

Brand-new domains are disproportionately used in scams — a domain registered three days before the message arrives is a red flag, especially when it imitates a well-known name. The tool reads the registration date from public domain registries (RDAP).

heuristic

Reply-To Mismatch

A message can declare a different address for replies than the one it was sent from. That is legitimate for newsletters and helpdesks, but in phishing it routinely redirects victims to a free webmail account controlled by the attacker.

heuristic

Link Inspection

Visible link text versus actual URL, redirect chains, link-shortener usage and IDN homograph attacks are all flagged. We never visit the links — only analyse them statically.

reputation

Sender network

We check whether any server in the message's delivery path belongs to a VPN provider or a Tor exit node. Legitimate mail rarely travels through anonymizing networks — in phishing it's a common way to hide the real origin.

authentication

BIMI

Brand Indicators for Message Identification — checks whether the sender's domain publishes a BIMI record with a logo, and validates any attached Mark Certificate (VMC). Displayed as a brand avatar in supporting mail clients.

cryptography

DKIM Signature

The sending server attaches a cryptographic signature covering the email's headers and body. The tool fetches the matching public key and recomputes the signature — if anything was changed after sending, the check fails.

policy

SPF Policy

Every domain publishes a list of mail servers allowed to send on its behalf. The tool reads that list and compares it with the IP that actually delivered the message.

policy

DMARC Alignment

The domain's owner declares what should happen when checks fail — accept, quarantine, or reject. The tool reports the policy and checks whether the visible From address aligns with the authenticated domain.

heuristic

Sender Identity

Phishing emails routinely fake the visible display name — a message signed "PayPal Security" <random@somewhere.tld> reads as PayPal in most clients. The tool compares display name with the actual sending domain and flags mismatches.

heuristic

Lookalike Domains

Attackers register domains that look almost identical to a real one — paypa1.com, microsoft.com (with a Cyrillic o), bank-secure.com. The tool inspects the sender domain for character substitutions, added words and mixed alphabets.

reputation

IP Reputation

The server that delivered the message is checked against several public blocklists used by mail operators worldwide. Presence on those lists is a strong indicator the address has been used to send spam, phishing or malware.

heuristic

Domain Age

Brand-new domains are disproportionately used in scams — a domain registered three days before the message arrives is a red flag, especially when it imitates a well-known name. The tool reads the registration date from public domain registries (RDAP).

heuristic

Reply-To Mismatch

A message can declare a different address for replies than the one it was sent from. That is legitimate for newsletters and helpdesks, but in phishing it routinely redirects victims to a free webmail account controlled by the attacker.

heuristic

Link Inspection

Visible link text versus actual URL, redirect chains, link-shortener usage and IDN homograph attacks are all flagged. We never visit the links — only analyse them statically.

reputation

Sender network

We check whether any server in the message's delivery path belongs to a VPN provider or a Tor exit node. Legitimate mail rarely travels through anonymizing networks — in phishing it's a common way to hide the real origin.

authentication

BIMI

Brand Indicators for Message Identification — checks whether the sender's domain publishes a BIMI record with a logo, and validates any attached Mark Certificate (VMC). Displayed as a brand avatar in supporting mail clients.

How is the tool built?

Four design decisions that shape what this tool can and can't see.

Runs locally

The analysis runs entirely in your browser. The email file is never uploaded — only public lookups about domains and IP addresses go out, never the message itself.

Per-signature detail

We show each cryptographic signature separately and label whether it was added by the sender's own domain or a third-party relay such as Amazon SES or SendGrid — not just a single overall pass/fail.

No accounts

No sign-up, no account, no history kept. Reload the page and the analysis is gone — there is nothing on a server to leak.

Plain & advanced

Two reading modes: a plain-language verdict for non-technical users, and an advanced mode that exposes raw authentication headers, domain records and route details for incident responders.

Where your email goes

The message file is opened and parsed locally in your browser. Its contents, headers and attachments never leave your device. The tool only sends public lookups about domains and IP addresses — never the message body or subject.

no upload no account