Phishing
Who really sent this email?
The name and address you see are whatever the sender typed. The headers underneath record which servers handled the message and whether it passed your provider’s checks. Paste them here to read them. Nothing is sent anywhere.
Path it took
Oldest first. The first hop is the closest to the sender; anything before the first server you trust could be invented.
| # | From | Received by | Address | Protocol | Time (UTC) | Delay |
|---|
All headers
Where to find the headers
Copy everything from the first line down to the first blank line. Pasting the whole message works too.
| Gmail | Open the message, then the ⋮ menu next to Reply, then Show original. |
|---|---|
| Outlook on the web | Open the message, then … (More actions), View, View message source. |
| Outlook for Windows | Open the message in its own window, then File, Properties. The headers are in the box at the bottom. |
| Apple Mail | Select the message, then View, Message, All Headers. Or View, Message, Raw Source. |
| Thunderbird | Select the message and press Ctrl+U (⌘U on a Mac). |
| Yahoo Mail | Open the message, then … (More), View raw message. |
| Proton Mail | Open the message, then the ⋯ menu, View headers. |
Reading the results
SPF checks that the server which delivered the message is on the sending domain’s list. DKIM checks a signature added by the sending domain, which breaks if the message is changed. DMARC is the one that matters for you: it passes only when SPF or DKIM passed for the same domain shown in From. A pass proves that domain sent it. Whether the domain belongs to who it claims is a separate question: anyone can register paypa1-support.com and set all three up correctly.
Only the top Authentication-Results header comes from your own provider. Anything lower down, and every Received line below your provider’s first one, was written by servers you can’t vouch for. Spammers add fake ones to cover their tracks.
If a message wants you to click, inspect the link before opening it.