Spam analysis for an incoming email starts with understanding the request and preserving useful evidence. The message may be unwanted marketing, impersonation, a credential theft attempt or another suspicious communication. A familiar-looking sender name is insufficient to establish legitimacy.
For domain owners, unexpected renewal, account-verification and auction messages deserve particular attention because they can request access or payment. Assess them through known provider channels.
Inspect the request without following it
Ask what the sender wants you to do: sign in, disclose information, open a file or make a payment. Check whether the request was expected and whether its timing or urgency can be verified independently.
The NCSC’s phishing guidance explains common deceptive communications and reporting routes. Good spelling or a copied logo does not certify the message.
Do not open a suspicious attachment merely because its filename looks familiar. A displayed link label can differ from the actual destination, and a shortened or redirected URL may obscure it further.
Check the complete address and relevant identity
Examine the sender address rather than only its display name. Read the relevant domain carefully for altered characters or unexpected word combinations. Our typo-domain guide covers those confusion patterns.
A genuine account can also be compromised, so even an expected address does not validate a changed payment instruction. Verify material requests through a known login or contact route obtained independently of the message.
Preserve headers for a supported investigation
Google’s full-header guidance explains Gmail’s Show original function. The raw message can provide routing and authentication context for your provider or responsible technical person.
Authentication results help answer specific identity questions; they do not certify the safety of the content. Avoid making a definitive diagnosis from one unfamiliar header field without understanding the trusted receiving system’s interpretation.
Keep the original message where your reporting process requires it, together with dates and what you observed. Forwarding or copying only visible text can lose useful context.
Use tools within their scope
Email test-score tools are generally intended to assess a sending workflow, not prove that an unknown incoming message is safe. A domain or IP blocklist query answers another limited question.
Do not submit confidential messages or files to public analysis services without understanding access and sharing conditions. If specialist analysis is needed, use the responsible organisation’s approved process.
Report and respond appropriately
Use the mail provider’s spam or phishing reporting controls and relevant official channels. Avoid replying to the suspicious message to request reassurance from the same unverified sender.
If information was disclosed or an account affected, follow the NCSC’s incident-specific guidance and the genuine provider’s recovery procedure promptly. Our brand-control guide helps maintain registration and recovery records.
The useful outcome is a supported decision and preserved evidence. Neither a polished message nor a clean tool result should replace independent verification of a sensitive request.