# Why Rookery flagged an email

When an email looks like a scam, Rookery marks it Possible phishing and lists the reasons, and holds the worst ones until someone checks. Here's what to do.

Staying safe · Updated October 16, 2026 · https://userookery.com/help/why-rookery-held-an-email/

Rookery checks every email as it lands. If something looks wrong, like a fake sender or a sudden "new bank details" request, Rookery marks the conversation **Possible phishing** and tells you why. On Today, it shows first with a **Flagged by Rookery** sticker.

## See why

1. Open the conversation. A red box says: "This could be a scam."
2. Read the reasons under it. The worst ones come first.
3. Click **Show the checks** to see every signal Rookery found. Each has a sticker: **Danger**, **Watch out** or **Good to know**.
4. At the bottom, the **Sender check** says whether authentication passed for the sender's domain, and how long you've known the sender. A pass doesn't verify the person's name or mean the email is safe.

## Forwarded email and privacy relays

Open a message's **⋯ → Show original** to see who it's really from, how it got here and its delivery evidence ([Read the original message](https://userookery.com/help/the-original-message/)). Forwarding can affect SPF and DKIM, so a failed check alone doesn't prove phishing.

- **Verified iCloud Hide My Email relay** means the receiver verified Apple's signature covering the relay header. The original address is what Apple's signed header identifies; Rookery hasn't independently authenticated that original address.
- **Forwarding authentication chain passed (ARC)** means the chain verified. It doesn't establish that the original sender is trustworthy or that the content is safe.
- **The headers indicate forwarding** is an unverified claim. A sender can add forwarding headers, so those headers alone never clear a warning.

Rookery receives the same delivery evidence on new mail. Relay evidence never overrides checks for dangerous links, attachments, impersonation or payment changes. Older messages keep their original Rookery decision; **Show original** reads their current header evidence when available.

## Reasons you might see

- It says it's from your own domain, but that couldn't be confirmed.
- The address looks like one you know, but it's a different domain, like `beansupp1y.example` instead of `beansupply.example`.
- The name shows one person or address, but the email came from somewhere else.
- It uses a teammate's name, but comes from outside.
- It comes from your own domain and uses a teammate's name or one of your inboxes' addresses, but it didn't come through Rookery: "This says it's from Jess, but it came from outside Rookery." Email between teammates is delivered inside Rookery, so a teammate's real email never arrives this way. The email shows a **Watch out** line under the sender, and the name is shown beside the address it came from. Rookery doesn't hold it for this alone.
- Replies would go to a different address than the sender.
- A link shows one website but goes to another.
- It has a program or a locked zip file attached.
- It looks like a signing request from DocuSign, Adobe Acrobat Sign, Dropbox Sign, PandaDoc or SignNow, but the link goes somewhere else, it didn't come from the service or someone you know, or it brings a web page to open instead.
- It talks about new bank or payment details.
- It says it's from a carrier like DHL or UPS, or that a delivery failed, but none of your orders in [Kept](https://userookery.com/help/kept/) mention that carrier, its tracking number or its order number. For example: "This says DHL, but none of your orders mention DHL." When it also asks you to pay before it delivers and another check failed (a lookalike address, a link that lies), Rookery treats it as a scam and holds it.
- It pushes you to act fast, or asks for a password, a code or a payment.

Some things that look odd are never a reason on their own, when the email proves it comes from its sender's own domain:

- A carrier or postal service writing from its own domain (a delivery notice, a daily mail digest) is never "none of your orders mention" it, and Rookery keeps its delivery.
- A company's link that shows its own name on another ending, like a card issuer's country site, is only a quiet note.
- "Log in to view your statement" from a sender you've had mail from before isn't a warning by itself. A first email asking you to sign in still is.

## What to do

1. Don't pay, change bank details, or share a code based on this email.
2. Check with the sender another way, using a phone number you already have.
3. For a signing request, open the signing service yourself (not from the email) and check the document is there. A real one is waiting in your account, or on the service's site with the security code from the email.
4. If it's a scam, leave it, or close the conversation.

## When Rookery holds an email

The worst ones, like a new bank account from a lookalike address, don't wait in your inbox. Rookery moves them to **Held by Rookery**: out of your turn, and Rookery won't draft or send a reply until someone checks. Today shows a calm line, like "1 held by Rookery · See why".

- **It's safe** moves it back to the inbox, and Rookery trusts that sender from then on (unless their mail looks forged). It asks you once more first.
- **Block sender** keeps their mail out.

## If Rookery got it wrong

On a flagged email that isn't held, click **It's not a scam** under the warning. You can also trust the sender from then on.

## Good to know

- A flagged email stays in your inbox with the warning. One that's held waits in **Held by Rookery**. Nothing is deleted either way.
- Rookery never drafts a reply to an email it flagged or is holding, even if you ask. Write it yourself after checking with the sender another way, or choose **It's not a scam** or **It's safe** first.
- "Good to know" signals, like "First email from this address", aren't a problem on their own. They help you judge the rest.
- Rookery only flags an email when it can name a specific sign, like a payment request, a code or a link that lies. A plain question, like "Are you an AI agent?", from someone new is not a warning sign. Every flag lists at least one reason.
- A real signing request from the service itself, or one someone you know sends with the service's own link, isn't flagged.
- If you forward mail from another account that uses your own domain, Rookery may flag it. We're working on that.
- Other email from your own domain that didn't come through Rookery, like a billing tool's, gets a quiet **Good to know**: "Sent from your domain, but not from Rookery."
- If some colleagues still use another mail service on your domain, like Google Workspace or Microsoft 365, an owner or admin can turn on **Some of us still send from another mail service** in **Settings → Inboxes**. Their email then gets **Good to know** instead of **Watch out**. Email claiming to be from one of your Rookery inboxes always gets the warning.
- **It's safe** counts on one side only. Said in your private inbox, it doesn't stop Rookery holding that sender's mail to a team inbox, and a teammate's **It's safe** on `support@` doesn't reach your private inbox.
- What Rookery knows about a sender comes from mail on the same side. A team inbox's warning never names someone only a private inbox has written to.