Sender check · Microsoft

Is accountprotection.microsoft.com a legit email?

Q: Is mydefender.microsoft.com a legit email?

It is a subdomain of microsoft.com, and only Microsoft can create those. The Microsoft Support pages we checked don’t name it as a sender, so judge each message by its headers: dmarc=pass for mydefender.microsoft.com means it came from Microsoft’s systems, anything else means it didn’t.

Is accountprotection.microsoft.com a legit email? Yes: Microsoft Support names account-security-noreply@accountprotection.microsoft.com as the Microsoft account team’s sender for unusual sign-in alerts. Fakes copy that address too, so here is how to tell a real alert from a forged one.

Updated October 10, 2026 · 3 min read

Short answer

Yes. Microsoft says an alert is legitimate if it comes from the Microsoft account team at account-security-noreply@accountprotection.microsoft.com. That only helps if the address wasn’t simply typed into the From line, so check that your provider recorded dmarc=pass for accountprotection.microsoft.com. Safest of all: don’t click anything in the email; sign in to your Microsoft account yourself and review the recent activity there.

The official Microsoft account security address

Domain or address	What Microsoft says	DMARC policy
`account-security-noreply@accountprotection.microsoft.com`	The Microsoft account team’s sender for alerts about unusual sign-in activity. Microsoft says an alert from this address is legitimate.	DMARC policy: p=reject
`microsoft.com`	Microsoft’s own domain; `accountprotection.microsoft.com` is a subdomain of it. The support pages we checked name no other sender address for account alerts.	DMARC policy: p=reject

Source: What happens if there’s an unusual sign-in to your account on Microsoft Support. Both accountprotection.microsoft.com and microsoft.com publish p=reject.

Checked October 10, 2026 against Microsoft’s own help pages. DMARC policies were looked up in public DNS on October 10, 2026. A p=reject policy tells receiving servers to refuse mail that fails DMARC for the domain.

Check a sender

Paste the sender’s address, and the headers if you have them. The scam email checker compares the domain with official brand domains and reads the SPF, DKIM and DMARC results. It shows signals, not a verdict.

Is account-security-noreply@accountprotection.microsoft.com legit?

Yes. Microsoft’s support article What happens if there’s an unusual sign-in to your account explains when the alert is sent and who sends it:

When Microsoft notices a sign-in attempt from a new location or device, it sends an email and an SMS alert, and may write to all the alternate contacts on the account.
It may ask you for a security code sent to one of those contacts, to confirm that it was you.
If you aren’t sure about an email, Microsoft says to check the sender: it is legitimate if it comes from the Microsoft account team at account-security-noreply@accountprotection.microsoft.com.

The same article adds a detail that helps against fakes: Microsoft’s support agents “are not allowed to send password reset links”, or to access and change account details. An email in which a “Microsoft agent” sends you a password reset link or offers to change your account details contradicts that.

The check Microsoft recommends doesn’t need the email at all. Sign in to the Security basics page of your Microsoft account by typing the address yourself, open the recent activity and mark anything you don’t recognize with This wasn’t me or Secure your account.

What about mydefender.microsoft.com and other Microsoft senders?

The Microsoft Support pages we checked name only this one address for account security alerts. For any other address, the domain tells you whose systems may have sent it:

A subdomain of microsoft.com, like accountprotection.microsoft.com or mydefender.microsoft.com, can only be created by Microsoft, because it controls the microsoft.com zone in the DNS. Whether one message really came from there is a question for the headers (next section).
A domain that only contains “microsoft”, like microsoft-account-alerts.example, belongs to whoever registered it.

How to check the headers of a Microsoft security alert

Your provider records what it verified in the topmost Authentication-Results header. In the new Outlook for Windows, open the message and select More actions > View > View message details; for Gmail and other apps see how to get the full headers. A genuine alert looks roughly like this (shortened):

Authentication-Results: mx.example.net;
  dkim=pass header.d=accountprotection.microsoft.com;
  spf=pass smtp.mailfrom=accountprotection.microsoft.com;
  dmarc=pass (p=REJECT) header.from=accountprotection.microsoft.com

dmarc=pass with header.from=accountprotection.microsoft.com means SPF or DKIM passed for a domain aligned with the From address (RFC 9989). Relaxed alignment lets a signature for microsoft.com count too.
dmarc=fail means the From address was forged. accountprotection.microsoft.com publishes p=reject, so providers that enforce DMARC normally refuse such mail.
Microsoft 365 mailboxes also show a compauth result, Microsoft’s combined verdict for the From domain. The email header analyzer explains it and reads all the verdicts for you.

Outlook does part of this for you. Microsoft says Outlook shows a banner that it “could not verify the sender” when something in the headers is suspicious, for example failed authentication (Protect yourself from phishing). Take that banner seriously on anything that claims to be from Microsoft. For background on p=reject, read what is a DMARC record.

Look-alike patterns in fake Microsoft emails

Microsoft’s own phishing guide lists the domain tricks to watch for: mail that claims to be from Microsoft but is sent from another domain, such as Gmail.com or microsoftsupport.ru, and subtle misspellings like micros0ft.com (a zero for the “o”) or rnicrosoft.com (“r” and “n” for “m”). The same patterns appear in other forms:

Brand plus lure words: microsoft-account-protection.example or accountprotection-microsoft.example. A hyphen where Microsoft’s address has a dot moves the address to a different domain.
The real domain in front: accountprotection.microsoft.com.secure-login.example belongs to secure-login.example.
Display-name spoofing: "Microsoft account team" <alerts@example.net>. Most apps show only the name until you open the sender details.
Generic greetings and urgency: Microsoft names “Dear sir or madam” openings and demands to act immediately as warning signs.

The scam email checker above compares the sender with Microsoft’s official domains and flags these patterns. More brands are in the sender checks.

Report a fake Microsoft email

In OutlookSelect the message, then Report > Report phishing. This works in Microsoft 365 Outlook and Outlook.com.
In any other mail appAttach the suspicious message to a new email to phish@office365.microsoft.com. Microsoft asks for the original as an attachment, not a forward, so it can read the headers.
Check your account directlySign in to the Security basics page of your Microsoft account yourself and select Review activity. Activity you don’t recognize can be marked there with This wasn’t me or Secure your account.

Sources

Brand help pages used for this check:

Frequently asked questions

Is account-security-noreply@accountprotection.microsoft.com a scam?

No, it is the address Microsoft names for its account team’s security alerts. A scam can show the same address in the From line, though. If your provider recorded dmarc=pass for accountprotection.microsoft.com, the message came from Microsoft. Either way, check the activity by signing in to your account yourself, not through the email.

Is mydefender.microsoft.com a legit email?

It is a subdomain of microsoft.com, and only Microsoft can create those. The Microsoft Support pages we checked don’t name it as a sender, so judge each message by its headers: dmarc=pass for mydefender.microsoft.com means it came from Microsoft’s systems, anything else means it didn’t.

Why did I get an unusual sign-in activity email from Microsoft?

Microsoft sends an email and a text when it notices a sign-in attempt from a new location or device, for example while you travel or after a new app signs in with your account. If you didn’t do anything different, review your account’s recent activity and change your password.

How do I report a fake Microsoft email?

In Outlook, select the message and choose Report > Report phishing. In other mail apps, attach the message to a new email to phish@office365.microsoft.com; Microsoft asks for an attachment rather than a forward so it can read the headers.

More sender checks

Facebook and facebookmail.comIs @support.facebook.com a legit email? Meta’s own list of sending domains (facebookmail.com, fb.com, meta.com), how to check headers, where to report fakes. Instagram security emailsIs security@mail.instagram.com a legit email? What Instagram’s help center confirms, which Meta addresses it also uses, how to check the headers, how to report. PayPal emailsIs service@paypal a real email? What PayPal confirms about its emails, why a genuine PayPal invoice can still be a scam, how to check headers and report fakes. Amazon emailsIs a “chargeback alert” from amazon.com a real email? Amazon’s own rules for its emails, how to confirm one in Message Center, check headers and report fakes. UPS delivery emailsIs pkginfo@ups.com a legit email address? Yes, UPS lists it. All nine UPS sender addresses, how to check the headers, how to spot and report fake delivery mail. Scam email checkerFree scam email checker: enter a sender’s address to spot look-alike brand domains, free or disposable senders, new domains and Reply-To tricks.