Read the original message

Updated New
View as Markdown

Every email has an original: the headers its mail servers added and the file exactly as it arrived. Open it from a message's ⋯ → Show original, or tap the sender's name and choose Show original.

Who it's really from

The answer comes first, in plain words:

  • Verified brand: Company means the sender's company has a brand certificate (BIMI) and the email passed its checks.
  • Really from lumen.example means the email passed the checks for the domain it says it's from.
  • Can't confirm this is from lumen.example means nothing proves it either way, and says why. Many small senders don't sign their email, and forwarding can break the checks.
  • Not from lumen.example means the domain publishes a rule that its own email passes these checks, and this one didn't.

Sometimes there's one more line, when it matters. For example, anyone can make a gmail.com address, so "Really from gmail.com" doesn't tell you who the person is.

When it looks like a scam

If Rookery flagged the email, or it's Not from the domain it claims, What to do comes first:

  • Don't click its links, open its files or pay anything it asks for.
  • If it might be real, check with them another way, using a phone number or address you already have.
  • Click Report to warn your team. The conversation gets the warning, with your name among the reasons, and no helper drafts or sends on it. If it turns out to be fine, choose It's not a scam at the top of the conversation.

How it got here

How it got here lists each mail server the email passed through, oldest first, with times in your time zone. If the email was forwarded, for example by Gmail, Rookery says so. That's why the SPF check names gmail.com: Google's server sent the last step, not the original sender.

What Rookery checked

A short list: whether any Links pretend to go somewhere else, the Attachments, any Lookalikes of names or domains you know, the Sender (a first email, or how long they've written to you), and whether it's Held, and why.

Replies and recipients

  • Replies go to shows where your reply goes. If that's not the address the email is from, Rookery says so. Check before you reply with anything private.
  • Sent to lists everyone it was addressed to, each address once. If it came to more than one of your addresses, Rookery kept one copy.

The technical details

Open Technical details for:

  • the SPF, DKIM, DMARC and ARC results, each with a sentence saying what it means
  • every header, with a search box. Point at a header's name to see what it's for. Copy headers copies them all.
  • Download .eml, the email's file exactly as it arrived, with its SHA-256. You can check a downloaded copy against it.