How to send us a suspicious email for automated analysis

Got an email that looks fishy? Don't delete it, and don't engage with it — forward it to us and you'll get back an automated verdict, usually within a few minutes. Here's exactly how to do it from any email app, what the reply means, and what to do next.

Why "forward as an attachment" matters

Every email carries hidden technical information — the sending server's IP address, authentication results (SPF, DKIM, DMARC), the real return path, and more. This is the forensic fingerprint that tells us whether the email actually came from who it claims to be from.

When you hit Forward normally, your email app strips that fingerprint and replaces it with yours. We get a copy of the words, but not the evidence. When you forward as an attachment, the original email is wrapped intact inside your new message — fingerprint and all.

How to forward as an attachment

Find your email app below. Each section shows the menu path and a numbered diagram you can follow.

Outlook on the web  ·  New Outlook for Windows

These two share the same interface. If you use Outlook in a browser at outlook.office.com, or the "new" Outlook desktop app on Windows, this is your path.

1. Open the suspicious email.
2. Click the … (More actions) button in the top-right of the message, then choose Other reply actions.
3. Click Forward as attachment. A new compose window opens with the email attached as a .eml file.
4. Send to [email protected]. You don't need to write anything in the body.

Classic Outlook for Windows

The traditional desktop app with the ribbon at the top. If your Outlook has tabs labeled Home, Send/Receive, Folder, etc. along the top, you're on classic Outlook.

1. In your inbox list, single-click the suspicious email to highlight it (don't open it).
2. On the Home tab, find the Respond group and click More (or the small dropdown arrow next to Forward).
3. Choose Forward as Attachment.
4. Send to [email protected].

Outlook for Mac

The fastest path on Mac is the right-click menu.

1. In your message list, right-click (or Control-click) the suspicious email.
2. Choose Forward as Attachment.
3. Send to [email protected].

Apple Mail  (macOS)

Apple Mail puts this option in the menu bar at the top of your screen.

1. Single-click the suspicious email in your message list.
2. At the top of the screen, click Message in the menu bar.
3. Choose Forward as Attachment.
4. Send to [email protected].

Gmail  (web)

If you have a Gmail account (or your work email runs on Google Workspace), the option lives in the message's three-dot menu.

1. Open the email at mail.google.com.
2. Click the ⋮ (More) menu in the top-right of the message header — not the one in the toolbar above the email list.
3. Choose Forward as attachment.
4. Send to [email protected].

On a phone or tablet

Most mobile email apps — Outlook Mobile, Gmail Mobile, Apple Mail on iPhone — don't have a "forward as attachment" option built in. You've got two good choices:

What happens after you send it

Your forwarded email lands in our analysis mailbox and gets picked up automatically. Behind the scenes, a series of checks runs against the sender's domain, authentication signals, links, attachments, and message content. The whole thing typically takes a few minutes.

You'll get an automated reply at the email address you forwarded from. The reply will have one of four outcomes — here's what each one looks like and what to do.

Understanding your reply

Phishing detected

The strongest verdict. The analysis found clear signals that the email is malicious — failed authentication, a known-bad link, a sender domain registered days ago, or a combination of red flags that don't have an innocent explanation.

Under review by our team

This is the most common verdict. The automated checks turned up something worth a closer look — not enough to call it phishing outright, but not clean either. A real person on our team is taking a look and will follow up directly.

Likely safe

The analysis didn't turn up anything that strongly indicates phishing or malicious intent. The sender's authentication checked out, and the links and attachments came back clean. We send this verdict sparingly — when there's any ambiguity at all, we route to Needs Review instead.

"We couldn't analyze this submission"

If the email address you forwarded from isn't recognized as belonging to one of our managed-client organizations, you'll see this response instead of a verdict. The service is included as part of managed IT and isn't something we run for the general public.

A few important reminders

Don't engage with the suspicious email while you're waiting

While the analysis runs, leave the original email alone. Don't click any links to "see where they go", don't open attachments to "check what they are", and don't reply — even with a quick "is this you?" because that just confirms your address is live for the attacker.

The most common red flags to trust

You don't need to wait for our analysis to recognize most phishing. A few habits catch the vast majority on their own:

• Unexpected urgency. "Your account will be locked in 24 hours." "Wire this payment by end of day." Urgency is the single most reliable phishing signal.
• The actual sender address doesn't match the display name. Click or tap the sender to reveal the underlying email address. "Microsoft Support" coming from [email protected] is a giveaway.
• Requests for passwords, MFA codes, or financial details over email. No legitimate bank, vendor, government agency, or IT provider will ever ask for these by email. Treat any request like this as phishing by default.
• Links you didn't expect. Hover (don't click) over links to preview where they actually go. If a "PayPal" email links to pp-billing-service.com, that's not PayPal.
• Out-of-band verification works for everything else. If you genuinely need to verify a request — an invoice change, a payment, a banking detail — call the sender at a number you already have on file. Not a number from the email. Not a reply to the email.

What we do with submissions

Raw submitted emails purge from our queue automatically after 48 hours. We retain the analysis summary (the verdict, what we found, the sender domain) for longer so we can spot campaigns hitting multiple clients at once — but the original email itself is short-lived. We don't share submissions with anyone outside our team.