Skip to content

Is this Microsoft email real? Check the sender

Microsoft account alerts come from a microsoft.com address, such as accountprotection.microsoft.com. Paste the sender’s address to see where an “unusual sign-in” email really comes from.

  • Is it really microsoft.com?
  • Free sender check
  • The sender is never notified

Look up an email address

Free check

No card needed. We never email the address you check.

How to check a Microsoft email

Sign-in alerts and storage warnings exist to send you to a fake login page. The sender’s domain gives it away first.

  1. Copy the real address

    Tap the sender name to reveal the full address and paste that, not the name shown.

  2. Check the domain

    See whether it is microsoft.com, when the domain was registered, and which provider runs the mailbox. Free.

  3. Check your account yourself

    Type account.microsoft.com into the browser and look at recent activity there.

What gives away a fake Microsoft email

Unusual sign-in alerts, full mailboxes, expired Microsoft 365 subscriptions and fake tech-support invoices.

The real Microsoft domain

  • Mail from microsoft.com or one of its subdomains
  • The domain’s registration date and registrar
  • Free mailboxes posing as Microsoft support

Lookalike giveaways

  • “microsoft”, “outlook” or “office” plus extra words
  • Letters swapped, like “rnicrosoft”
  • A Microsoft domain placed in front of another domain

Sender authentication

  • SPF published or missing
  • DMARC published or missing
  • Mail provider behind the domain

Who is behind it

  • Accounts tied to the address
  • Names shown publicly
  • In the full report

Microsoft emails worth checking first

  • “Unusual sign-in activity” on your account
  • “Your mailbox is full” or “password expires today”
  • A Microsoft 365 renewal you did not expect
  • A support invoice with a number to call
Check an email

Microsoft scam email questions

What address does Microsoft send security alerts from?

Account security alerts come from a microsoft.com address, such as accountprotection.microsoft.com. An alert from any other domain is not from Microsoft, whatever the logo says.

The email says my mailbox is full or my password expires. Is it real?

That is the most common Microsoft 365 phishing email. If you use a work account, ask your IT team; otherwise sign in at a Microsoft address you typed yourself and see whether anything is actually wrong.

Does Microsoft call or email about viruses on my computer?

No. Microsoft does not send unsolicited messages or calls offering tech support or refunds. An email asking you to call about a virus or an invoice is a tech-support scam.

Where do I report a fake Microsoft email?

In Outlook, use the Report phishing option. In any mail app, mark it as phishing and delete it.

Does the sender find out I checked?

No. Nothing is sent to the address and nobody is notified. The check reads DNS records, the domain registration and public sources only.

Guides worth reading

All articles

Check the sender before you reply to Microsoft

The free check takes ten seconds, and nothing is sent to the address.

Check an emailSee pricing