---
title: "Email sender verification"
description: "OpenEmail shows whether a message came from the domain it names, reading the DMARC, DKIM and SPF results the receiving servers stated on arrival."
url: "https://openemail.uk/features/verified-sender"
---

[Safety & authenticity](https://openemail.uk/features.md#safety)

# Verified sender Read from the delivery, not the message.

Every message you receive gets a Sender check built from what DMARC, DKIM and SPF said on arrival. A pass counts only when the servers that took the message in reported it.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[All features](https://openemail.uk/features.md)

In short

## How is an email sender verified?

Anyone can type any address into the From line. SPF lists the servers allowed to send for a domain, DKIM signs each message, and DMARC passes when either one checks out for the From domain.

How it works

## Checked once, as it arrives

The receiving servers test the message as it arrived and write the result on the delivery. Opening it later shows that record, not a fresh check.

## Claims inside a message are not believed

Authentication-Results is an ordinary header any sender can write. One carried inside the message is a stranger's report and never confirms the sender.

## DMARC decides, SPF does not

Forwarding breaks SPF and an added footer can break DKIM, so a DMARC pass confirms the domain. The check still names what broke.

What you get

## In the product today

Warnings come first

A message flagged as unsafe never shows its sender as confirmed.

Logos are not proof

A brand logo earns no seal, and is hidden when DMARC did not pass.

Each mechanism named

DMARC, DKIM and SPF each show Clear, Flagged or No result.

Who said it

Details also names who reported the result.

Good practice

## Getting the most out of it

1. 01
   
   Check before you pay
   
   Before paying an unexpected invoice, open Details and read the Sender check.
2. 02
   
   Read the domain itself
   
   A lookalike domain can pass every check, because whoever sent it owns that domain.
3. 03
   
   Unconfirmed means unknown
   
   Plenty of ordinary mail proves nothing either way, so judge it by what it asks you to do.

Where it stands

## Good to know

Questions

## Asked often

Keep going

## Works well with

Phishing & spam filtering

Mail the sending domain itself disowns lands in Spam rather than the inbox.

Sender pictures

A real picture for everyone you correspond with when one can be found, and a mark seeded on their identity when it cannot.

DMARC policy

A starter p=none record, printed to copy or written by a sync, never tightened for you.

Start

## Your domain, your mail.

Point a domain at OpenEmail and read it in a mailbox built around it. The free plan covers one domain.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[Read the reference](https://openemail.uk/docs/knowledge/safety/verified-sender.md)