How to verify a forwarded email is genuine

Why forwarded emails cannot be trusted

When someone forwards an email, the original DKIM signature is stripped. The forwarded text becomes fully editable — anyone can change an amount, a date, or even the sender's name. There is no way to tell by looking at the text whether it has been altered.

This matters when the email is being used as evidence: in a legal dispute, a visa application, a compliance check, or a fraud investigation.

What is DKIM?

DKIM (DomainKeys Identified Mail) is a standard that lets a mail server sign outgoing messages with a cryptographic key. The signature covers the message body and selected headers (From, Subject, Date, etc.).

If even one character of the signed content changes after signing, the signature becomes invalid. This is what makes DKIM useful for verification — it is a tamper seal, not a stamp of approval.

How to verify a forwarded email

What the verification establishes — and what it does not

A valid DKIM signature establishes that the content has not been modified since the sender's mail server signed it. It does not establish that the content of the message is true, that a specific person wrote it, or that the sending account was not compromised.

SelfCheck states these limits clearly on every report.

Next steps

Try it now — drop an .eml file on the homepage. For professional use, create a free account to save reports with trusted timestamps.