Thousands of fake emails land in inboxes that look perfectly innocent. The good news: you can peek behind the curtain in one minute. The From address is just a label anyone can type. Scammers forge it in seconds, and it still looks official. But every email carries a hidden travel diary: headers, recording which computers handled it. Receivers run three famous checks on those records. SPF asks: is this server allowed to send for that domain? DKIM asks: does the message carry a valid signature from that domain? DMARC asks: does the domain you see line up with the verified ones? In Gmail, tap the sender details and look for Mailed by and Signed by. A question mark beside the sender means the checks did not line up. Passing proves the identity matched, not that the content is harmless. Failing does not prove fraud. Even real mailing lists can fail. Treat authentication as one clue, never the whole verdict. Habit one: glance at who the message claims to be from. Habit two: be careful with replies, links, and attachments. Habit three: if in doubt, use a website or number you trust. The From field can lie. The header trail tells the story. Now you know where to look.
