An email can look genuine and still be fake. The sender name can be copied, the logo stolen, and even the visible address spoofed. That is why Gmail hides two powerful clues inside every message: the “mailed-by” and “signed-by” fields.
These two fields tell you which server actually sent the message and which domain cryptographically signed it. When they match the sender you expect, the message is far more likely to be legitimate. When they point to a strange or unrelated domain, that is a warning sign you should not ignore. Learning to check them takes less than a minute, and it is one of the simplest habits you can build to protect yourself from phishing.
Quick Answer
Open the email in Gmail, click the three-dot menu or the small details arrow near the sender name, and look for the “mailed-by” and “signed-by” lines in the header details. The mailed-by field shows the domain of the server that sent the message, and the signed-by field shows the domain that added a digital signature to it. If both match the real sender’s domain, the message passed an important authenticity check.
What Do Mailed-By and Signed-By Actually Mean?
Think of an email like a parcel. Anyone can write a name on the front, so what matters is the postmark and the courier’s tamper-proof seal. In email, mailed-by is like the postmark, and signed-by is like that seal.
Understanding the Mailed-By Field
The mailed-by field shows the domain of the mail server that delivered the message to Gmail. For example, a genuine newsletter from a large company might show a mailed-by value that belongs to that company or to the professional email service it uses to send bulk mail. This is normal. Many businesses use services such as mailing platforms to send messages, so the mailed-by domain does not always have to be identical to the address you see, but it should be explainable and related to the sender’s business.
Problems appear when the mailed-by domain looks random, misspelled, or completely unrelated. A message claiming to be from your bank but mailed by an unknown domain with a string of random letters deserves immediate suspicion.
Understanding the Signed-By Field
The signed-by field is based on a technology called DKIM, which stands for DomainKeys Identified Mail. When a sender signs a message, their mail server adds a digital signature using a private key that only they control. Receiving servers can check that signature against a public key published in the sender’s DNS records. If the signature is valid, it proves the message really came from that domain and was not altered on the way.
When you see a signed-by domain that matches the sender’s domain, that is a strong positive signal. When the signed-by field is missing, it does not automatically mean the email is fake, because some small or older mail systems do not sign every message. It does mean you should be more careful, especially if the message asks for money, passwords, or urgent action.
How to Check the Fields on a Computer
The full header details are easiest to read on a desktop or laptop browser, where Gmail shows the complete information panel.
- Open Gmail in your browser and sign in to your account.
- Click the email you want to verify to open it fully.
- Look at the sender line at the top of the message, just under the subject.
- Click the small downward arrow or the words that show details, next to your own address. On some layouts, click the three dots on the right side of the message and choose the option to show details.
- Read the panel that appears. It lists the sender, the recipient, the date, the subject, and then the mailed-by and signed-by lines when they are available.
- Compare both domains carefully with the sender’s real domain, letter by letter.
If you want even deeper information, you can use the three-dot menu and choose “Show original.” That page shows the full message headers, including authentication results for SPF, DKIM, and DMARC. Look for words such as PASS next to each check. Google explains these authentication methods on its official guide to checking if an email was encrypted and authenticated, which is worth bookmarking if you verify messages often.
How to Check the Fields on a Phone
The Gmail mobile app shows less detail than the desktop version, but you can still get useful information.
- Open the Gmail app and tap the message you want to check.
- Tap the sender name or the small arrow next to it to expand the details.
- Review the “to” and “from” information that appears.
- If the mailed-by and signed-by lines are not visible, open the same message later on a computer for the full view, especially before clicking any link in it.
If a message feels urgent and you are only on your phone, wait, avoid tapping links, and verify it properly on a larger screen. Scammers rely on people acting quickly on small screens where details are hidden.
How to Judge What You Find
Finding the fields is only half the job. You also need to interpret them correctly.
Signs That Point to a Genuine Message
- The signed-by domain matches the sender’s domain exactly.
- The mailed-by domain belongs to the sender or to a known email service they plausibly use.
- The message content matches what you expect, such as a receipt for something you actually bought.
- Links inside the message, when you hover over them without clicking, lead to the real company domain.
Signs That Should Make You Stop
- The signed-by field is missing on a message claiming to be from a bank, payment service, or large company that normally signs its mail.
- The mailed-by domain is a lookalike, such as a domain with an extra letter, a swapped character, or a different ending.
- The message creates panic, threatens account closure, or demands an immediate payment or password reset.
- The sender asks you to move the conversation to a different channel or to reply to a different address.
Remember that these fields are one layer of checking, not the only layer. A message can pass authentication and still contain a bad request if a real account was compromised. Always combine the header check with common sense about what the message is asking you to do. For a broader set of search and safety skills, our complete guide to the best Gmail search operators can help you find and audit similar messages from the same sender across your inbox.
What Are SPF, DKIM, and DMARC in Simple Words?
These three names appear in the “Show original” view and work as a team. SPF lists the servers allowed to send mail for a domain. DKIM adds the digital signature behind the signed-by field. DMARC ties them together and tells receiving servers what to do when a message fails, such as sending it to spam. You only need to read the results: three PASS results, with matching domains, give good confidence, while a FAIL on a message asking for sensitive action is a clear reason to stop and verify through a separate channel.
Common Mistakes and Useful Tips
- Trusting the display name alone: Anyone can set a display name to a bank or a boss’s name. Always check the actual address and the header fields.
- Ignoring small spelling differences: A single changed letter in a domain is a classic trick. Read domains slowly, character by character.
- Assuming no signed-by means definite fraud: Some legitimate small senders do not sign mail. Treat it as a reason for extra care, not instant proof.
- Clicking first and checking later: Always verify before you click links or download attachments, not after.
- Replying to ask if the email is real: If the account is spoofed or compromised, the reply may go to the attacker. Contact the sender through a phone number or website you find independently.
Conclusion
The mailed-by and signed-by fields are small lines of text, but they reveal a lot about where an email really came from. Mailed-by shows which domain’s server sent the message, and signed-by shows which domain digitally signed it. When both align with the sender you expect, and the full headers show PASS results, you can trust the message with much more confidence. Make this thirty-second check a habit for any email that involves money, logins, or urgency, and you will avoid most common phishing traps.
Frequently Asked Questions
Why do some legitimate emails have no signed-by field?
Some smaller companies and older systems do not set up DKIM signing. Their mail can still be genuine, but it lacks that extra proof, so be more cautious and verify any request for payment or personal information through another channel.
Can a phishing email ever show a correct signed-by field?
Yes, in rare cases, for example if an attacker registers a lookalike domain and sets up proper signing for it, or if a real account is compromised. That is why you must check that the signed domain matches the real company domain exactly, and stay alert to unusual requests even when authentication passes.
What should I do if the mailed-by domain does not match the sender?
Do not click links or download attachments. A mismatch can be harmless when a company uses a mailing service, but if the domain looks random or misspelled, treat the message as suspicious. Contact the supposed sender using contact details from their official website, and report the message as phishing in Gmail.
Where can I see SPF and DMARC results for a message?
Open the message, click the three-dot menu, and choose “Show original.” The top of that page summarises SPF, DKIM, and DMARC with PASS or FAIL results. This view is available in Gmail on a computer and gives the most complete authentication picture for any single message.
Is checking these fields enough to stay safe from all scams?
No single check is enough on its own. Header checks confirm where a message came from, but you should also question unexpected requests, hover over links before clicking, keep your account protected with two-step verification, and never share verification codes with anyone who contacts you first.
Leave a Reply