Sender check · PayPal

Is service@paypal a real email?

Is service@paypal a real email? “service@paypal” isn’t a complete address: the domain after the @ decides, not the name before it. A message from an address on paypal.com that passes DMARC came from PayPal’s systems; a forged one fails that check. Here is what PayPal does confirm and how to check.

Updated October 10, 2026 · 4 min read

Short answer

PayPal’s help pages don’t name service@paypal.com or any other sender address (checked October 2026). What they do confirm: real PayPal emails greet you by your full name or business name, show PayPal’s logo with a checkmark in supporting inboxes, and PayPal only asks for your password on its own login page. paypal.com publishes p=reject, so an email from @paypal.com with dmarc=pass in the headers came from PayPal’s systems. Even then, check the request inside: scammers send real PayPal invoices and money requests.

What PayPal confirms about its emails

paypal.comPayPal’s own domain, where its website and help center live.DMARC policy: p=reject
Your full namePayPal emails address you by the first and last name (or business name) on your account, never “Dear user” or “Hello PayPal member”.
Logo and checkmarkAn authentic PayPal email shows PayPal’s logo and a checkmark in the inbox of providers that support BIMI, such as Apple, Gmail and Yahoo.
Your PayPal activityA payment you really received always shows in your PayPal activity. Log in directly to check.

Sources for these signs: How do I spot a fake PayPal email, How to identify fake messages.

Checked October 10, 2026 against PayPal’s own help pages. DMARC policies were looked up in public DNS on October 10, 2026. A p=reject policy tells receiving servers to refuse mail that fails DMARC for the domain.

Check a sender

Paste the sender’s address, and the headers if you have them. The scam email checker compares the domain with official brand domains and reads the SPF, DKIM and DMARC results. It shows signals, not a verdict.

Copy it from the email, with the name if you like: PayPal Service <service@example.net>

Add the email headers (optional, more signals)

Runs in your browser. To check the domain, its name (never the full address or the headers) goes to Cloudflare’s public DNS resolver and to rdap.org for the registration date.

Is service@paypal.com a legit email address?

The domain is PayPal’s: its website and help center live on paypal.com. Whether one particular email from service@paypal.com is genuine is something no name before the @ can tell you, for two reasons:

Add the ending and it gets clearer: service@paypal.com is on PayPal’s domain; service@paypal-support.example or service@paypal.com.account-review.example are not, however familiar the start looks.

PayPal’s own signs of a real email, from the pages above:

Real PayPal emails that are still scams

Some PayPal scams don’t fake PayPal’s email at all. PayPal’s list of common scams describes invoices and money requests that a fraudster sends through PayPal itself, for a product or service you never ordered, sometimes with an alarmist note telling you to call a “customer service” number. The notification about such an invoice is a genuine PayPal email and passes every check on this page. The note inside was written by the scammer.

PayPal’s advice: don’t pay it, don’t call phone numbers in the note, don’t open unfamiliar links, and report the invoice or request after logging in to the PayPal website or app. The same logic applies to “you’ve received a payment” emails: a payment you really received always shows in your PayPal activity, so check there before you ship anything.

How to check the headers of a PayPal email

Open the full headers (Gmail on a computer: More > Show original; other apps: see how to get the full headers) and read the topmost Authentication-Results, the one your provider wrote. A message that really comes from PayPal’s domain looks roughly like this (shortened):

Authentication-Results: mx.example.net;
  dkim=pass header.d=paypal.com;
  spf=pass smtp.mailfrom=paypal.com;
  dmarc=pass (p=REJECT) header.from=paypal.com
  1. Find header.from. It must be paypal.com or a subdomain of it. If it says something else, the email comes from that domain.
  2. Look for dmarc=pass. DMARC passes when SPF or DKIM passed for a domain aligned with the From address (RFC 9989). A pass for any subdomain of paypal.com aligns too.
  3. Treat dmarc=fail as forged. paypal.com publishes p=reject, so providers that enforce DMARC normally refuse such mail. If one still reached you, through a forwarding rule for example, it is not from PayPal.

The email header analyzer reads these results for you; what is a DMARC record explains the policy behind p=reject.

Look-alike patterns in fake PayPal emails

A forged paypal.com sender fails DMARC, so fakes that want to get past the checks use domains the scammer controls:

The checker above flags each of these and compares the sender with PayPal’s official domains. Other brands are in the sender checks.

Report a fake PayPal email

  1. Forward it to PayPalForward the entire email to phishing@paypal.com, then delete it. Suspicious text messages go to the same address (PayPal: report suspicious messages).
  2. Unexpected invoice or money requestDon’t pay it and don’t call a number in the note. Report it after logging in to the PayPal website or app (PayPal: common scams).
  3. Check your account yourselfType paypal.com into the browser or open the app and look at your activity and the Resolution Center instead of using links in the email.

Sources

Brand help pages used for this check:

Frequently asked questions

Is service@paypal.com a legit email?

PayPal doesn’t list its sender addresses, but paypal.com is PayPal’s domain. If the headers show dmarc=pass for paypal.com, the email came from PayPal’s systems. Check the greeting (your full name), and open your PayPal account yourself instead of using links in the email.

Is service@intl.paypal.com real?

intl.paypal.com is a subdomain of paypal.com, which only PayPal can create, but PayPal’s help pages don’t name it. Judge the message by its headers: dmarc=pass for intl.paypal.com means it came from PayPal’s systems; a fail or a different domain means it didn’t.

Can a real PayPal invoice be a scam?

Yes. PayPal warns about invoices and money requests sent through PayPal for things you never ordered, sometimes with a note urging you to call a fake customer service number. The email is genuine; the sender of the invoice is not. Don’t pay it, don’t call the number, and report it in your PayPal account.

How do I report a fake PayPal email?

Forward the entire email to phishing@paypal.com and delete it. PayPal uses the same address for suspicious text messages.

More sender checks

Facebook and facebookmail.comIs @support.facebook.com a legit email? Meta’s own list of sending domains (facebookmail.com, fb.com, meta.com), how to check headers, where to report fakes. Instagram security emailsIs security@mail.instagram.com a legit email? What Instagram’s help center confirms, which Meta addresses it also uses, how to check the headers, how to report. Microsoft account security alertsIs accountprotection.microsoft.com a legit email? The one alert sender Microsoft names, how to check a message’s headers, common fakes and how to report them. Amazon emailsIs a “chargeback alert” from amazon.com a real email? Amazon’s own rules for its emails, how to confirm one in Message Center, check headers and report fakes. UPS delivery emailsIs pkginfo@ups.com a legit email address? Yes, UPS lists it. All nine UPS sender addresses, how to check the headers, how to spot and report fake delivery mail. Scam email checkerFree scam email checker: enter a sender’s address to spot look-alike brand domains, free or disposable senders, new domains and Reply-To tricks.

Start using our email validation software today!

Get 100 validations per month for free