Guide · about 5 minutes
Read the evidence behind a result
The technical evidence under a Jatzo result, one part at a time. Each is a clue, and none on its own proves an email is safe.
The sender
Compare the name with the address. Anyone can set the name, and it is the first thing a scam gets right; the part after the @ is the one that is hard to fake and the one to read.
Where replies go
Reply-To and Return-Path can differ from the sender. Mailing services do this for ordinary reasons; a scam does it so your answer reaches them rather than the person they are pretending to be.
SPF, DKIM and DMARC
These show whether a domain authorised the email. A pass only proves the domain sent it, and criminals own domains too, so a pass is never a reason to trust what the message asks for.
The route it took
The servers that passed the email along, newest at the top. A country or a cloud provider is context rather than proof: most mail passes through somewhere that looks surprising.
Your provider's spam verdict
When the email came through your own mailbox, your provider's junk rating is included. It says unwanted rather than dangerous, and an accusation from it counts for more than a clean verdict.
Put it together
Headers are one layer. What the email asks for, where its links go and what is attached matter as much, and a message can pass every check here and still be the one that costs you money.
