# How to recognise a phishing email? | SmartMail > A phishing email is recognised by sender verification, a spoofed domain, a misleading link and a payment request. Checklist and SmartMail's checks. Source page: https://dblinx.net/en/smartmail/blog/kimlik-avi-maili-nasil-anlasilir --- Security # How to recognise a phishing email? A phishing email often looks like a familiar sender. You can tell by checking whether the sender really wrote from that domain, letter tricks in the domain, where the link actually goes, and any request for payment or bank details in the email. - [Security](/en/smartmail/blog/#etiket-guvenlik) - [Phishing](/en/smartmail/blog/#etiket-kimlik-avi) - [Fraud](/en/smartmail/blog/#etiket-dolandiricilik) SmartMail team4 min readPublished: 17.10.2026 A phishing email disguises itself as a trusted sender to get the recipient to click a link, enter a password or make a payment. In organizations, the most expensive type is the one that comes in the name of a familiar supplier or manager and says that bank details have changed. The good news is that almost all of these emails carry the same few traces, and these traces can be checked systematically. ## Is the sender really writing from that domain? Anyone can write whatever they like in the "From" line shown by email clients. The real evidence is the three checks the receiving server performs when it accepts the email: **SPF** says whether the server sending the email is authorised to send on behalf of that domain, **DKIM** says whether the email arrived signed without being changed in transit, and **DMARC** says whether these two results match the visible sender. If all three fail, or the DMARC result is "fail", the email may not have come from that organization, whatever the display name says. ## Is there a small letter trick in the domain? Attackers often get an address that looks very similar to the real domain: tedarikci-firma replaced by tedarikci-flrma, a visually similar character in place of a letter, or an added word at the end. The eye misses this difference when reading quickly. A new sender whose address differs by one letter from a company you have corresponded with before is one of the strongest signs of phishing. ## Where will the reply go, where does the link lead? In some fake emails the "From" looks correct, but when you press **Reply** the reply goes to a different address (Reply-To mismatch). Links use a similar trick: the visible text is a bank's address, while the address opened on click is different. Hovering over the link and reading the actual address is the cheapest check before clicking. ## Checklist - Is the sender identity verified (SPF, DKIM, DMARC)? - Does the domain look similar to the one of the company you are communicating with, differing by only a couple of letters? - Is the reply address different from the visible sender? - Is the link's visible text the same as the address it leads to? - Does the mail request a new IBAN, changed bank details or an urgent payment? - Is it someone you have never corresponded with before, or a new contact at the same organization? - Is the language pressuring you or asking for privacy? **Caution**Before updating bank details or making a payment, call the other party on a phone number you already know. Do not use the number or link in the email. ## How SmartMail solves this - **Every email is checked before it is opened:** SPF, DKIM and DMARC results, similar domain, reply address mismatch and misleading link are checked; the result appears as a badge next to the sender name. - **The reason for the decision is written:** clicking the badge opens the risk score and findings item by item. - **Fraud banner:** a warning appears at the top of the reading screen when someone writing for the first time is combined with changed bank details or a payment request from a domain resembling a familiar company. - **Quarantine:** an email below the trust threshold does not reach the inbox; it can be reviewed in quarantine with the reason. [Email security](/en/smartmail/guvenlik)[Reading the security report](/en/smartmail/belgeler/kullanici/guvenlik-raporunu-okuma)[Fraud warning](/en/smartmail/belgeler/kullanici/dolandiricilik-uyarisi) ## Frequently asked questions If the display name is correct, is the email safe? No. The display name and the “From” line can be freely written. The real proof is the SPF, DKIM and DMARC results; SmartMail shows these in the report that opens when you click the badge. How is a similar domain detected? The sender's domain name is compared character by character against your domain name or companies the mailbox has previously corresponded with; new addresses that are similar with one or two character differences are flagged. What should I do with a suspicious email? Do not click the link, open the attachment or make a payment. In SmartMail, you can quarantine the email or report it to your administrator; if there is a payment request, call the other party from a number you know. ## Try SmartMail with your own mailboxes In the demo account, you can explore every screen with sample data. [Open the demo](https://mail.dblinx.net/demo/)[Buy](https://app.dblinx.net/satin-al?urun=smartmail) ## Related articles - [Administration ### What is a corporate email audit log: who did what, and when? The audit log is a list of significant actions performed in corporate email, recording who did them and when; it cannot be edited or deleted from the dashboard. It is the first place to look when an email goes missing, someone is granted access by mistake or a rule changes. 2 min read](/en/smartmail/blog/kurumsal-e-posta-denetim-kaydi) - [Administration ### Email archive and recovery: how to recover deleted mail? A deleted email does not disappear immediately; it remains in the trash for the period determined by the organization and can be restored during that time. For emails that are no longer needed but must be kept, archiving rather than deleting is the right approach: archiving removes the email from the inbox but does not delete it. 2 min read](/en/smartmail/blog/silinen-maili-geri-getirme) - [Team collaboration ### Internal team notes and @mentions: how do you communicate on an email without it reaching the customer? A team note is an explanation left on an email that only the team can see. It does not go to the other party; everyone who sees the same mailbox sees it. When you type a colleague's name with @, they receive a notification; so internal correspondence stays alongside the email without telling the customer “just a minute, let us ask”. 2 min read](/en/smartmail/blog/e-posta-ekip-notu-ve-bahsetme)