How to investigate a phishing email with a perfect trust score
A perfect sender or domain trust score can feel reassuring, but it is only one signal in a broader email security investigation. A reputable domain may be impersonated through a compromised mailbox, a fraudulent message may use a legitimate marketing platform, or the visible sender name may hide a different technical address.
This matters in Australia, where scam emails often imitate banks, myGov, Australia Post, Medicare, NBN providers, and online retailers. Before clicking a link or opening an attachment, examine the message, verify the sender through an independent channel, and preserve evidence for reporting.
| Check | What it can confirm | What it cannot prove |
|---|---|---|
| Domain trust score | The domain has a positive reputation history | The individual message is genuine |
| SPF, DKIM and DMARC | Whether sending infrastructure is authorised and authenticated | That the content is safe or the account is uncompromised |
| Reply-To address | Where a response will actually go | Whether the original mailbox was hacked |
| Link destination | The site a click would open | Whether a familiar-looking site is legitimate |
| Message context | Whether the request fits normal business activity | That a trusted brand sent the email |
Separate domain reputation from message authenticity
A domain reputation service evaluates signals associated with a domain, such as historical abuse, configuration, authentication, and suspicious activity. It does not read the sender’s intentions or guarantee that every mailbox under that domain is safe. A trusted supplier’s account could be compromised and used to send a convincing invoice scam.
First, inspect the complete “From” address rather than relying on the display name. Check the envelope sender, Reply-To field, and the domains used by embedded links. A message that appears to come from an Australian bank but directs replies to a free webmail address deserves immediate suspicion.
Authentication results provide useful evidence. SPF checks whether the sending server is authorised, DKIM checks whether a cryptographic signature matches the message, and DMARC compares the authenticated domain with the visible From domain. A pass improves confidence, but it does not remove the risk of a hijacked account or malicious content sent through an approved service.
Examine the message for social engineering
Phishing emails create urgency: an overdue toll notice, a parcel awaiting payment, a PayID transfer problem, or a request to confirm Medicare details. The wording may contain subtle inconsistencies, such as an unusual payment method, a threat of immediate account closure, or a request to bypass normal approval procedures.
Hover over links without opening them and compare the destination with the organisation’s genuine website. Look for misspelled domains, extra subdomains, shortened links, URL redirects, and newly registered lookalikes. Be especially careful with messages imitating Australia Post during periods of heavy online shopping in Sydney, Melbourne, Brisbane, and other major cities.
Attachments require equal caution. Unexpected HTML files, password-protected archives, macros, and invoices requesting a new bank account should be treated as potentially harmful. Preserve the original email file and full headers because forwarding or copying the message can remove evidence needed for analysis.
Verify through an independent channel
Do not use the telephone number, link, or reply address provided in the suspicious message. Open the organisation’s official website manually, use a known number from a previous statement, or contact a supplier through an established business relationship. For a purported bank alert, sign in through the bank’s normal app rather than the email button.
Australian recipients can report scams to Scamwatch and suspicious cyber activity to the Australian Cyber Security Centre. If personal information has been exposed, the Privacy Act 1988 and the Notifiable Data Breaches scheme may become relevant to the affected organisation. Businesses should involve their security or incident-response team before deleting mailboxes or resetting accounts.
A sender score can support this process when used as one part of the evidence. The platform usage guide explains how to review domain reputation and authentication indicators without treating a favourable result as a final verdict.
Check for compromise and lookalike infrastructure
A perfect score may belong to the legitimate parent domain while the email uses a subtly different domain, such as a substituted letter, an extra hyphen, or an unfamiliar country-code extension. Compare the registered domain from right to left. In notice.example.com.au, the important organisational domain is example.com.au, while notice is only a subdomain.
If the domain is genuinely correct, investigate whether an employee, supplier, or cloud account has been compromised. Review sign-in logs, mailbox forwarding rules, unusual OAuth grants, recent password changes, and unfamiliar devices. A sudden request to change payment details should be confirmed verbally, even when the message passes SPF, DKIM, and DMARC.
Domain age, certificate details, DNS changes, and related infrastructure can reveal a campaign that reputation systems have not yet seen. This is particularly relevant to newly created domains used in short-lived scams targeting Australian consumers during tax time, major sales events, or natural-disaster appeals.
Record findings and automate repeat checks
Capture the sender address, subject, timestamps, message ID, authentication results, URLs, attachment hashes, and screenshots. Record whether anyone clicked a link, entered credentials, transferred money, or opened an attachment. If credentials were entered, change them from a clean device, enable multifactor authentication, and contact the relevant bank immediately.
Security teams managing many domains can use API reputation scoring to check newly registered domains and add trust signals to registration or monitoring workflows. Automation should flag unusual changes for review rather than automatically declaring a message safe.
The practical rule is simple: a perfect domain score means “continue investigating,” not “click with confidence.” Content, authentication alignment, link behaviour, account activity, and independent verification must support the same conclusion before a suspicious email is trusted.