Fake Email Address Checker

Instantly verify if an email address is real, disposable, or fake. Detect spoofed domains, throwaway accounts, invalid domains, and suspicious patterns.

Live DNS & MX lookup Disposable email detection SPF & DMARC check 100% free
​
Please enter a valid email address (e.g. [email protected])
Trust score

How Our Fake Email Address Checker Works

We run 8 independent checks covering syntax, real-time DNS lookups, email authentication records, and known threat patterns to give you an accurate trust verdict.

1

Enter the email address

Paste any email address you want to verify - from a contact form, sign-up, or a suspicious message you received.

2

8 checks run instantly

We verify syntax, query live DNS for the domain and MX records, check SPF and DMARC, and scan for disposable providers and spoofing patterns.

3

Get a verdict and trust score

See a pass/fail breakdown per check, a 0–100 trust score, and a clear verdict - Legitimate, Suspicious, or Fake.

8 Checks That Identify a Fake Email Address

Each check targets a different signal. Critical checks - missing domain, no MX, disposable provider - are immediate red flags. Warning checks add context to the overall risk score.

Syntax validation

Verifies the address follows RFC 5322 format - correct structure, valid characters, no double dots, proper TLD. Invalid syntax is an instant fail.

Domain DNS lookup

Live DNS query to verify the email domain actually exists and resolves. A domain with no DNS records cannot be a real email address.

MX record check

Queries live DNS for an MX (Mail Exchanger) record. No MX record means the domain cannot receive email - a strong indicator the address is fake or unused.

SPF record check

Looks up the domain's SPF TXT record. Domains without SPF have no protection against spoofing - a red flag for addresses claiming to be from a reputable sender.

DMARC record check

Queries _dmarc.domain for a DMARC policy. Absence of DMARC means the domain is unprotected and can be freely spoofed by attackers.

Disposable email detection

Checks the domain against a list of 500+ known throwaway and temporary email providers - Mailinator, Guerrilla Mail, 10minutemail, and more.

Typosquatting detection

Identifies domains engineered to look like trusted providers - gooogle.com, gmial.com - a common technique in phishing and business email compromise attacks.

Role-based & free provider

Flags generic role addresses (info@, noreply@, admin@) and identifies free consumer providers. Neither is fake, but both carry higher risk and lower deliverability.

What to Do If You Received a Fake or Spoofed Email

Receiving a fake email - especially one impersonating a brand or colleague - is a security incident. Here's what to do immediately and how to protect yourself going forward.

1

Do not click any links or download attachments

Fake emails frequently contain malicious links that lead to credential-harvesting pages or attachments that install malware. Hover over links to inspect the URL before clicking - or don't click at all.

2

Do not reply or provide any information

Replying to a spoofed or phishing email confirms your address is active and monitored. Never provide passwords, codes, financial details, or personal information in response to an unsolicited email.

3

Verify through a separate, trusted channel

If the email appears to be from a known sender - your bank, a vendor, or a colleague - verify it by calling them directly or logging in independently. Do not use contact details from the suspicious email.

4

Report the email as phishing or spam

Use your email client's "Report phishing" or "Mark as spam" function. This helps train spam filters and protects other users. You can also report to your national cybersecurity agency (e.g. CISA in the US, NCSC in the UK).

5

Check the email headers for origin clues

Email headers reveal the true sending server, IP address, and authentication results (SPF, DKIM, DMARC). Use an email header analyzer to trace whether the message came from the domain it claims to represent.

6

If you clicked a link - act quickly

Change passwords for any accounts you accessed after clicking. Enable two-factor authentication. Run a malware scan. If financial information was entered, contact your bank immediately and monitor your accounts.

7

Notify your IT or security team

If you received a fake email at a work address, report it to your IT or security team immediately - even if you didn't interact with it. BEC attacks often begin with reconnaissance emails, and your report could prevent a larger attack.

8

If your domain is being spoofed - deploy DMARC

If attackers send fake emails pretending to come from your domain, implement DMARC with a reject policy. DMARC instructs receiving servers to block unauthenticated email claiming to be from your domain, protecting your brand and customers.

What Is a Fake Email Address?

A fake email address is any address that doesn't belong to a real, identifiable person, cannot receive email, or is designed to deceive. They appear in phishing attacks, spam campaigns, fraudulent sign-ups, and business email compromise (BEC) schemes - and they cost businesses billions annually.

Common Types of Fake Email Addresses

Disposable / temporary emails are real addresses created on throwaway services like Mailinator or 10minutemail. They can receive email briefly but are anonymous by design - commonly used to bypass sign-up verification without exposing a real inbox.

Spoofed addresses forge the sender's identity to impersonate a trusted brand or person. The display name may read "PayPal Support" while the actual address is [email protected]. DMARC, SPF, and DKIM are specifically designed to stop this.

Non-existent addresses use domains with no DNS records or no MX record - meaning email sent to them will bounce. These are often fabricated for form submissions or generated automatically by bots.

Typosquatted domains register domains that closely resemble trusted brands - amaz0n.com, micosoft.com - to deceive both humans and automated filters. These are a key vector in phishing campaigns targeting customers of major brands.

Why Fake Emails Are Dangerous

Fake email addresses are the entry point for most phishing, BEC, and fraud attacks. For businesses, they cause hard bounces that damage sender reputation, skew analytics, waste sales resources on non-existent leads, and expose systems to abuse through sign-up forms.

If attackers are sending fake emails that appear to come from your domain, it directly damages your brand reputation and puts your customers at risk. Deploying DMARC with a reject policy is the definitive way to prevent this - it instructs receiving mail servers to block any email claiming to be from your domain that hasn't been authenticated via SPF and DKIM.

Frequently Asked Questions

Our tool catches the most common types: invalid syntax, non-existent domains, missing MX records, disposable providers, typosquatted domains, and addresses without SPF or DMARC. However, a sophisticated attacker who registers a legitimate-looking domain with valid MX records may achieve a passing score. Use this as one layer of verification alongside email authentication protocols.

 

An MX (Mail Exchanger) record is the DNS record that tells the internet which mail server handles email for a domain. If a domain has no MX record, it cannot receive email — any address at that domain is effectively non-functional. This is one of the strongest indicators that an email address is fake or that the domain has been abandoned.

Email spoofing is the act of forging the “From” field in an email to make it appear to come from a trusted sender. Without DMARC, SPF, and DKIM authentication, anyone can send an email claiming to be from any domain. Spoofed emails are the primary vehicle for phishing attacks, CEO fraud, and brand impersonation campaigns.

No. Free provider addresses like Gmail and Yahoo are widely used legitimately. Our tool flags them as informational because they carry higher abuse risk — anyone can create unlimited free accounts at scale. The verdict depends on all signals combined, not any single check.

 

Implement DMARC, SPF, and DKIM on your domain. SPF lists the servers authorized to send email as your domain. DKIM adds a cryptographic signature to outgoing email. DMARC ties them together and instructs receiving servers to reject or quarantine unauthenticated messages. Without all three in place, your domain can be freely spoofed.

Try More Email Authentication Tools

Strengthen your domain security with our free lookup tools:

''

<'' id="aposapos" class='av_textblock_section 'av-316cu286'-3befd6e3f248a7079ba25e40ce1b26bb '' avia-fold-textblock-wrap avia-fold-init av-fold-textblock-'av-316cu286'-3befd6e3f248a7079ba25e40ce1b26bb '' ''' data-fold_unfold="{"type":"&apos;&apos;","height":"&apos;&apos;","more":"&apos;Read","less":"&apos;Read","context":"avia_sc_text"}" >
'Read

SPF
Generator

''

<'' id="aposapos" class='av_textblock_section 'av-2l26ihdy'-59aca39f0ce7770ec281305212f490b8 '' avia-fold-textblock-wrap avia-fold-init av-fold-textblock-'av-2l26ihdy'-59aca39f0ce7770ec281305212f490b8 '' ''' data-fold_unfold="{"type":"&apos;&apos;","height":"&apos;&apos;","more":"&apos;Read","less":"&apos;Read","context":"avia_sc_text"}" >
'Read

SPF Record
Checker

''

<'' id="aposapos" class='av_textblock_section 'av-26r6k7ly'-6074bf8f8fc251d182c7a349ef9a0472 '' avia-fold-textblock-wrap avia-fold-init av-fold-textblock-'av-26r6k7ly'-6074bf8f8fc251d182c7a349ef9a0472 '' ''' data-fold_unfold="{"type":"&apos;&apos;","height":"&apos;&apos;","more":"&apos;Read","less":"&apos;Read","context":"avia_sc_text"}" >
'Read

DKIM
Checker

''

<'' id="aposapos" class='av_textblock_section 'av-1tt6pb9i'-003400abe18cb09a6601898a7112ad9b '' avia-fold-textblock-wrap avia-fold-init av-fold-textblock-'av-1tt6pb9i'-003400abe18cb09a6601898a7112ad9b '' ''' data-fold_unfold="{"type":"&apos;&apos;","height":"&apos;&apos;","more":"&apos;Read","less":"&apos;Read","context":"avia_sc_text"}" >
'Read

BIMI
Checker

''

<'' id="aposapos" class='av_textblock_section 'av-1gxmd4ue'-e316cc876e28a4d9e7e10d8549710a9f '' avia-fold-textblock-wrap avia-fold-init av-fold-textblock-'av-1gxmd4ue'-e316cc876e28a4d9e7e10d8549710a9f '' ''' data-fold_unfold="{"type":"&apos;&apos;","height":"&apos;&apos;","more":"&apos;Read","less":"&apos;Read","context":"avia_sc_text"}" >
'Read

DMARC
Checker

Follow a manual added link
Follow a manual added link <'' id="aposapos" class='av_textblock_section 'av-y8aw8zq'-3f65119a57ceb20e0da82b305abd4b39 '' avia-fold-textblock-wrap avia-fold-init av-fold-textblock-'av-y8aw8zq'-3f65119a57ceb20e0da82b305abd4b39 '' ''' data-fold_unfold="{"type":"&apos;&apos;","height":"&apos;&apos;","more":"&apos;Read","less":"&apos;Read","context":"avia_sc_text"}" >
'Read

Stop Email Spoofing with DMARC Enforcement


If attackers are sending fake emails from your domain, DMARC stops them. PowerDMARC makes it easy to deploy, monitor, and enforce DMARC, SPF, and DKIM — and protect your brand.


'Book '

Follow a manual added link