# Read the original message

Show original says who an email is really from, how it got to you, what Rookery checked and where replies go, with the technical details folded underneath.

Staying safe with Scout · Updated October 16, 2026 · https://userookery.com/help/the-original-message/

Every email has an original: the headers its mail servers added and the file exactly as it arrived. Open it from a message's **⋯ → Show original**, or tap the sender's name and choose **Show original**.

## Who it's really from

The answer comes first, in plain words:

- **Verified brand: Company** means the sender's company has a brand certificate (BIMI) and the email passed its checks.
- **Really from lumen.example** means the email passed the checks for the domain it says it's from.
- **Can't confirm this is from lumen.example** means nothing proves it either way, and says why. Many small senders don't sign their email, and forwarding can break the checks.
- **Not from lumen.example** means the domain publishes a rule that its own email passes these checks, and this one didn't.

Sometimes there's one more line, when it matters. For example, anyone can make a gmail.com address, so "Really from gmail.com" doesn't tell you who the person is.

## When it looks like a scam

If Rookery flagged the email, or it's **Not from** the domain it claims, **What to do** comes first:

- Don't click its links, open its files or pay anything it asks for.
- If it might be real, check with them another way, using a phone number or address you already have.
- Click **Report** to warn your team. The conversation gets the warning, with your name among the reasons, and no helper drafts or sends on it. If it turns out to be fine, choose **It's not a scam** at the top of the conversation.

## How it got here

**How it got here** lists each mail server the email passed through, oldest first, with times in your time zone. If the email was forwarded, for example by Gmail, Rookery says so. That's why the SPF check names gmail.com: Google's server sent the last step, not the original sender.

## What Rookery checked

A short list: whether any **Links** pretend to go somewhere else, the **Attachments**, any **Lookalikes** of names or domains you know, the **Sender** (a first email, or how long they've written to you), and whether it's **Held**, and why.

## Replies and recipients

- **Replies go to** shows where your reply goes. If that's not the address the email is from, Rookery says so. Check before you reply with anything private.
- **Sent to** lists everyone it was addressed to, each address once. If it came to more than one of your addresses, Rookery kept one copy.

## The technical details

Open **Technical details** for:

- the **SPF**, **DKIM**, **DMARC** and **ARC** results, each with a sentence saying what it means
- every header, with a search box. Point at a header's name to see what it's for. **Copy headers** copies them all.
- **Download .eml**, the email's file exactly as it arrived, with its **SHA-256**. You can check a downloaded copy against it.