Anti-Phishing Email Check

The Anti-Phishing Email Check verifies whether a scary "action required" email is real or phishing before you click anything or share credentials. It is the five-minute triage from a real case: a "developer portal now open, complete the intake" email that turned out authentic (proper SPF, DKIM, and DMARC authentication, direct links, no redirectors) and would have been caught in sixty seconds if it had not been. The workflow has five steps. First, read the headers: in Gmail, open the message and choose "Show original", then check Authentication-Results for spf=pass, dkim=pass, and dmarc=pass, all three, with the DKIM d= domain matching the claimed sender's domain rather than a lookalike. Second, inspect every link: the visible text means nothing, the real destination is the href. Red flags are URL shorteners, redirector domains, punycode and lookalike domains, and mismatched display versus destination. Third, check the ask: credential demands, password resets, payments, or "urgent" downloads deserve high alert, and legitimate senders rarely lead with urgency plus a link. When in doubt, do not use the email's link: navigate to the official site yourself and look for the same notice in your account. Fourth, cross-check the channel: a real "portal is open" email has a public counterpart on the company's site, status page, or verified social. Fifth, decide: authentic means proceed via your own navigation, suspicious means report as phishing and delete, and if you already clicked, rotate the exposed credential immediately. The operating rules are simple: headers before links, because authentication results are harder to fake than link text. A familiar logo, your name, or "we have emailed before" proves nothing. Approval to read an email is never approval to click its links. Never forward a suspicious email's links to someone else "to check": describe it in words. And if mixed signals leave you inconclusive, treat it as suspicious and contact the company through a known-good channel.