Official Brand Email Addresses: Is This Sender Legit?

Q: Is an email from a subdomain of a brand’s domain legit?

A subdomain such as support.facebook.com or mail.instagram.com can only be created by the owner of the main domain, so it belongs to the brand. A domain that merely contains the brand name, like facebook-support.example, belongs to whoever registered it. Whether one message came from the brand still depends on DMARC passing for that domain.

How these sender checks work

Each page answers one question people search for, such as “is pkginfo@ups.com a legit email address”, with what the brand itself publishes:

Only the brand’s own pages count. Every address and domain in the tables comes from the brand’s help center, linked on the page with the date it was checked. If a brand doesn’t confirm an address people ask about, the page says so and shows what the brand does confirm instead. PayPal, for example, publishes no list of sender addresses.
The DMARC policy of each domain was looked up in public DNS on the same day. p=reject asks receiving servers to refuse mail that fails DMARC for the domain, p=quarantine to treat it as suspicious. More in what is a DMARC record, or look up any domain with the DMARC checker.
No verdict on messages we haven’t seen. An official address in the From line is a claim, not proof. Each page shows how to check the proof in the headers.

Is an official brand email address always legit?

No. The From line is text the sender writes, and anyone can write service@paypal.com there. Three things decide whether an email really comes from a brand:

The domain after the @. It must be one the brand names, or a subdomain of one: security@mail.instagram.com is on Instagram’s domain, security@mail-instagram.example is not.
DMARC in your provider’s verdict. The topmost Authentication-Results header shows dmarc=pass only if SPF or DKIM passed for a domain aligned with the From address. The email header analyzer reads it for you.
The brand’s own record of what it sent. Facebook and Instagram (Recent emails) and Amazon (Message Center) list the emails they sent you inside your account. A message that isn’t there didn’t come from them.

Even a message that passes all three can carry a scam: a real PayPal invoice from a fraudster, or a genuine Meta notification about a stranger’s request. The pages above link the brand’s own advice for those cases and its official address for reporting phishing.

Check a sender

Paste the sender’s address, and the headers if you have them. The scam email checker compares the domain with official brand domains and reads the SPF, DKIM and DMARC results. It shows signals, not a verdict.

Frequently asked questions

How can I verify a company’s official email address?

Look for the company’s own help page about fake or phishing emails; many list the domains or addresses they send from. Then check the message itself: the topmost Authentication-Results header should show dmarc=pass for that domain. The sender checks on this page link each brand’s official page.

Is an email from a subdomain of a brand’s domain legit?

A subdomain such as support.facebook.com or mail.instagram.com can only be created by the owner of the main domain, so it belongs to the brand. A domain that merely contains the brand name, like facebook-support.example, belongs to whoever registered it. Whether one message came from the brand still depends on DMARC passing for that domain.

Can an email from an official address still be a scam?

Yes. Brands deliver content written by other people: Meta has warned of phishing links in real Business Manager partner requests from facebookmail.com, and PayPal warns of scam invoices sent through PayPal itself. A hacked account can also send from a genuine address. Treat unexpected requests for money, passwords or codes with suspicion whatever the sender.

Why are only a few brands listed?

A sender check needs the brand’s own published list of sending domains or addresses, so we add brands one by one after checking their help pages. For any other sender, the scam email checker compares the domain with official domains of about 175 frequently impersonated brands.

Official brand email addresses: is this sender legit?

Brands checked so far