Warnings about who sent a message

Anyone can write any name and address on an email, and phishing mail often comes from a domain made to look like one you trust. When you open a message, webmail says what suggests it is not from who it seems, above the message in red:

It failed the sender's checks. The sender's domain publishes a DMARC policy, and this message did not pass it when it arrived, so it may not be from that domain at all. (Domains that ask for it have such mail refused or put in Junk; this is mail their policy lets through.)
The domain looks like one you know. The sender's domain imitates your organization's, one of your contacts', or a well-known brand's (banks, PayPal, Microsoft, Apple, Google, Amazon, delivery companies and more):
- letters swapped for ones that look the same (раypal.com with a Cyrillic "р", rnicrosoft.com with "rn" for "m", paypa1.com);
- spelt slightly differently (acme-wigdets.com);
- another ending (acme-widgets.co for acme-widgets.com);
- a known domain hidden inside a longer one (paypal.com.secure-login.net), or with a word added (paypal-secure.com).
The name shows another address. The sender's name is an address ("support@paypal.com" <someone@elsewhere>), so a mail app that shows only names shows the wrong one.
Replies go to a look-alike domain. The message's Reply-To would send your answer to a domain that imitates one you know.

A grey note instead says when nothing confirms the sender: their domain publishes no policy that lets mail servers check its mail. That is common and not a sign of trouble by itself; just don't trust such a message more than its content deserves.

Mail from people on your organization's domains, and mail you sent, never shows these. The checks use only what this server recorded when the message arrived, which no sender can fake.

What to do

Don't click links, open attachments, pay, or send anything a warned message asks for. If it may be real, contact the sender another way (a number or address you already have). Mark it as spam to teach your filter, or ask your administrator to block the domain.

See also SPF, DKIM and DMARC and Spam and Junk.