Spotting a Fake Password Reset Email Through Domain Authentication

That email asking you to reset your banking password might not actually come from your bank. In Australia, the ACSC reports millions of phishing attempts each year, and password reset lures remain one of the most common entry points for credential theft. Whether you live in Perth, Brisbane or Hobart, the same pattern repeats across inboxes nationwide.

Genuine password reset requests follow a predictable path from the sender's server to your mailbox. That path leaves digital fingerprints in the form of authentication records, and these fingerprints are the most reliable way to separate a real message from a clever impersonation.

Domain authentication works through three coordinated mechanisms. SPF authorises the mail servers permitted to send on behalf of a domain, DKIM attaches a cryptographic signature that confirms the message was not altered in transit, and DMARC ties those signals together with a policy that tells receivers how to handle failures. When all three pass, the message almost certainly originated from the claimed sender.

Trusted Sender Score, operated by Zulu Labs Inc., gives you a free way to interrogate these records for any domain that emails you. The platform offers bulk domain checking, developer tools and an API, so individuals and security teams across Australian organisations can verify senders before trusting a single link. You can read about the project on the about page.

Reading SPF, DKIM and DMARC Without a Technical Background

You do not need to be a systems administrator in a Sydney data centre to interpret email authentication. Start with the visible sender, which usually shows a friendly name alongside an address. The address reveals the actual domain, and that domain is what the three protocols check.

A legitimate password reset from your bank will show the institution's verified domain in the From header and will pass SPF, DKIM and DMARC. A spoofed message often uses a lookalike domain such as "paypaI.com" with a capital I instead of a lowercase l, or an unrelated domain that simply displays the brand in the display name. Always read the actual address rather than relying on the friendly name.

If you want to confirm a sender before clicking, copy the sending domain and run it through a reputation service. Security teams responsible for vendor onboarding can streamline this by screening third-party vendors in batches, a practice that stops partner domains from becoming an open door for credential harvesting.

Inspecting the Authentication Results Hidden in the Header

Every email carries a header that records its journey across the internet. In Gmail, open the message, click the three dots and choose "Show original." In Outlook, open "View message details." Apple Mail users on a Mac can use the "Show Raw Source" option or terminal tools. The header includes a line labelled "Authentication-Results" that summarises the SPF, DKIM and DMARC verdict.

When authentication passes, you will see the word "pass" alongside each protocol. When it fails, you may see "softfail," "hardfail" or "none," which means no policy was published. A password reset request claiming to come from a major Australian brand such as the ATO or Australia Post should always carry a published DMARC record, and the absence of one is a strong warning sign that the sender is not genuine.

Recognising the Lures That Target Australian Inboxes

Local scammers tailor their spoofs to recognisable brands. Fake ATO messages threaten recipients in Melbourne and Adelaide with fabricated tax debts. Fake Australia Post notifications tell you a parcel awaits redelivery. Fake Optus or Telstra messages reference the 2022 data breach and offer a phony security update. Each of these uses password reset themes to harvest credentials.

The approach is consistent. The message creates urgency, references a familiar brand and pushes you toward a login page that steals your details. Even when the visible sender looks correct, the underlying authentication can betray the impersonation. That is why checking the technical layer matters more than reading the body text.

Tracing Redirect Chains That Hide the True Destination

Before you click any link in a password reset email, hover over it to preview the destination. Spoofers commonly hide their real endpoint behind a chain of redirects that travel through compromised websites, often hosted on servers in different countries to mask the original source.

A redirect chain may start with a domain that resembles the real one and bounce through several unrelated hosts before landing on a phishing kit. A detailed walkthrough of identifying a redirect chain that hides the original source is available for anyone who wants to dig deeper into this technique.

Confirming Through the Service Itself Before You Act

The safest habit is to never trust a link inside a password reset email. Instead, open your browser and navigate directly to the service. If your bank genuinely needs a reset, you will see the request waiting in your account settings. The same rule works for ATO matters, telcos and government services such as MyGov. If you cannot find a matching notification, treat the email as hostile.

Report suspicious messages to Scamwatch and the ACSC, then delete the email. Combining this habit with regular domain authentication checks builds a layered defence that turns the inbox from a vulnerability into a well-monitored gateway.