# Who an email is from

What the header on every email means: the one mark beside the name, the quiet line under it, and the details when you tap it.

Staying safe with Scout · Updated October 16, 2026 · https://userookery.com/help/who-an-email-is-from/

Every email in a conversation starts the same way: the sender's face and name, at most one mark, the time and **⋯**. Under the name, a quiet line says where the email came from and who it went to. On a phone, the header is never more than two lines.

## The one mark

There's room for one mark beside the name, so you never see a reassuring mark and a warning together.

- **A blue seal with a check** means the sender's company has a brand certificate and its logo checked out, like a bank or a large shop. Hover over it to read "Verified: Company's brand certificate". It's the only check mark Rookery shows.
- **Internal** means a teammate sent it inside Rookery. It never went over email.
- **Confidential** means your team marked the conversation confidential.
- **Newsletter** means it's a newsletter you're subscribed to.
- **A warning** comes first, always: **Rookery flagged this**, **Failed the sender check**, **Not from Rookery** (it uses one of your addresses but didn't come from Rookery) or **Not confirmed** (nothing could confirm the sender's domain sent it).

An email that simply passes the usual checks gets no mark. A pass only says the sender's domain sent it, not that the person is who they say or that the email is safe.

## The quiet line

- **Where it came from**: the sender's domain, like `lumen.example`. If something else delivered it, the line says so: **via Square** for a shop's receipt sent through Square, **via iCloud Hide My Email** for mail relayed by Apple, or **via Gmail forwarding**.
- **Who it went to**: **to you**, **to you and 2 others**, **to support@** for another of your addresses, or **to your Hide My Email address**. On your own emails, it says who you sent them to.
- **The full address**, only for someone who hasn't written before. It's cut in the middle when the line is short, so the domain stays readable.

## Who it says it's from

- Your own emails say **You**.
- A helper's email that you or a teammate approved says **Rookery for** and that person's name, like **Rookery for Maya**.
- Your own email that comes back to you, for example forwarded by Gmail, says **You** and **came back through Gmail forwarding**. Rookery recognises its own emails, so you don't get a warning about yourself. An email that only claims to be from your address still gets the warning.

## Tap the header for the details

Tap or click the name to open **Details**:

- **From**, and **Reply-To** if replies go somewhere else.
- **To**, **Cc** and, on your own emails, **Bcc**.
- **Date**, in full, in your time zone.
- **Mailed by** and **Signed by**: the domains that sent and signed it.
- **Security**: one sentence about who it's really from.
- **Show original** opens the checks and every header.

To fold an earlier email again, use **⋯ → Fold this email**.