Validating the sender
SPF, DKIM, DMARC, reverse DNS, and related headers help assess whether the message came from the claimed sender.
EMAIL REVIEW · CHECK THE EVIDENCE
Looks suspicious.
Let’s inspect it.
Send us the original email as an attachment. We’ll check the sender signals, inspect the content, and report back with what the evidence can—and cannot—establish.
THE REVIEW ADDRESS
Drop your suspicious email here.
Forward it as an attachment so its original headers and message content stay together.
KEEP THE ORIGINAL EVIDENCE
How to send it
A normal forward often rewrites the sender and strips or changes authentication headers. Send the original message as an attached .eml instead.
01 OutlookForward as attachment
- Select the suspicious message in your inbox.
- Choose Forward as Attachment from the message menu. In Outlook desktop, you can also open a new message and drag the original email into it.
- Address the new message to check@looksleg.it and send.
Outlook’s menu wording varies by version. The goal is to attach the original message, usually as an .eml file.
02 GmailForward as attachment · one or many
- From your inbox/list view, select the checkbox beside one suspicious message—or select several messages to send them together.
- In the toolbar, open More (three dots) and choose Forward as attachment. Gmail opens a new draft with the original message or messages attached as
.emlfiles. - Address the draft to check@looksleg.it and send.
You can forward one message or select multiple messages first. Use Forward as attachment, not the regular Forward button, which can rewrite the sender context.
A CLEAR, SEPARATE REVIEW
What happens next
Investigating the content
Links, requests, urgency, attachments, and reply destinations are assessed separately. Sender authentication does not prove content is safe.
We’ll report back by email. The report separates sender validation from the content verdict and identifies missing or limited checks.