---
title: "The Number One Clue to a Phishing Email (and what to do about it) | DuoCircle"
description: "If you take an email security awareness training class, you’ll learn a dozen ways to spot phishing email. There are a lot of clues."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/phishing-protection/the-number-one-clue-to-a-phishing-email-and-what-to-do-about-it/"
---

Quick Answer

The single most reliable phishing indicator is the From address. If you can verify who actually sent the message, you can decide whether to trust it. The hard part: attackers spend their effort on disguising From, and the three protocols meant to lock it down (SPF, DKIM, DMARC) leave gaps. Dark Reading documented research finding 18 distinct techniques to spoof From past these protocols across major providers including Gmail, iCloud, Outlook, and Yahoo. The protocols were designed independently and combine inconsistently in real-world implementations. Practical guidance for users: never trust the display name (always the actual email address), check the domain character by character, and treat unexpected requests from familiar names as suspicious until verified through another channel. Organizational defense: cloud-based phishing protection that inspects From signals and blocks known-malicious senders before delivery.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fthe-number-one-clue-to-a-phishing-email-and-what-to-do-about-it%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=The%20Number%20One%20Clue%20to%20a%20Phishing%20Email%20%28and%20what%20to%20do%20about%20it%29&url=undefined%2Fblog%2Fphishing-protection%2Fthe-number-one-clue-to-a-phishing-email-and-what-to-do-about-it%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fthe-number-one-clue-to-a-phishing-email-and-what-to-do-about-it%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fthe-number-one-clue-to-a-phishing-email-and-what-to-do-about-it%2F&title=The%20Number%20One%20Clue%20to%20a%20Phishing%20Email%20%28and%20what%20to%20do%20about%20it%29 "Share on Reddit") [ ](mailto:?subject=The%20Number%20One%20Clue%20to%20a%20Phishing%20Email%20%28and%20what%20to%20do%20about%20it%29&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fthe-number-one-clue-to-a-phishing-email-and-what-to-do-about-it%2F "Share via Email") 

![phishing email](https://media.mailhop.org/duocircle/images/2020/07/hosted-email-server-8711.jpg) 

_If you take an email security awareness training class, you’ll learn a dozen ways to **spot phishing email**_. There are a lot of clues. Maybe the email contains poor spelling or grammar. Or maybe it contains an offer that’s just too good to be true. All of those are giveaways. But there is one clue that’s a more reliable predictor of a phishing email than any other one: the “from” address. If you truly know who the email is from, you’ll know whether or not it’s legitimate.

_The challenge is that hackers spend all their time trying to camouflage the from address so you think it’s from somebody it isn’t_. And they are really good at it.

[![DMARC](https://media.mailhop.org/duocircle/images/2020/07/dmarc-report-6128.jpg)](https://media.mailhop.org/duocircle/images/2020/07/dmarc-report-6128.jpg)

To counteract this **email obfuscation**, the industry has responded with three technologies that make it harder for hackers to hide the from address. The three technologies are [SPF](https://en.wikipedia.org/wiki/Sender%5FPolicy%5FFramework) (Sender Policy Framework), [DKIM](https://en.wikipedia.org/wiki/DomainKeys%5FIdentified%5FMail) (Domain Keys Identified Mail) and [DMARC](https://en.wikipedia.org/wiki/DMARC) (Domain-based Message Authentication Reporting and Conformance). You might think these three technologies would make hackers pack up their bags and go home, but you’d be wrong, because as things turn out, _these technologies aren’t foolproof_.

According to an [article](https://www.darkreading.com/vulnerabilities---threats/email-security-features-fail-to-prevent-phishable-from-addresses/d/d-id/1338448) on Dark Reading, “_Researchers have discovered 18 different ways of fooling the triumvirate of email technologies, SPF, DKIM, and DMARC, for a subset of email services_, including Gmail, and clients, including Microsoft Outlook. While the three technologies should ensure the FROM header of an email cannot be spoofed, for example, stating that the email comes from [security@gmail.com](mailto:security@gmail.com) when, in fact, an attacker has sent it from their own mail server, \[it\] _undermines the authentication that the three technologies are designed to provide._”

So, what’s the problem? As it turns out, _the three technologies were built as standalone components and nobody bothered to check if they work well together_. “At a high level, this is a general problem, which is that we build complex systems these days out of components that we get from different parties, and those parties can have inconsistencies in really minor ways that turn out to have **security implications**.”

[![phishing protection](https://media.mailhop.org/duocircle/images/2020/07/phishing-protection-4148.jpg)](https://media.mailhop.org/duocircle/images/2020/07/phishing-protection-4148.jpg)

_This inability to work well together causes problems for everyone_. ” Every email provider, including Google’s Gmail.com, Apple’s iCloud.com, Microsoft’s Outlook.com, and Yahoo.com, had at least one issue that resulted in mismatched authentication.”

The bad news is, even when you implement all three of these technologies, _you’re not really protected from phishing attacks_. The good news? You can still protect yourself from **phishing attacks** with a third, more effective technology: _**cloud-based Phishing Protection** with real-time link scanning from DuoCircle._

[Phishing Protection](/email/phishing-protection) is specifically designed to sniff out malicious “from” addresses. And since it’s cloud based, when it does, it keeps that email out of your inbox completely. If you don’t see it, how can you get phished? You can’t.

_**Phishing Protection** requires no hardware, no software and no maintenance. It sets up in 10 minutes_, works with all major email providers and only costs pennies per user per month. If you’ve implemented the three technologies and you’re still feeling a little uneasy, check out Phishing Protection. Try it **free for 60 days**.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fthe-number-one-clue-to-a-phishing-email-and-what-to-do-about-it%2F) [ ](https://twitter.com/intent/tweet?text=The%20Number%20One%20Clue%20to%20a%20Phishing%20Email%20%28and%20what%20to%20do%20about%20it%29&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fthe-number-one-clue-to-a-phishing-email-and-what-to-do-about-it%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fthe-number-one-clue-to-a-phishing-email-and-what-to-do-about-it%2F) Copy 

Related Articles

- [ ![AI-Generated Phishing](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4522.jpg)  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Phishing ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)
- [ ![spf-permerror-4555](https://media.mailhop.org/duocircle/images/2023/05/spf-permerror-4555.jpg)  10 Applications of ChatGPT that Hackers Are Already Exploiting Phishing ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)
- [ ![Email-Based Cyber-Attacks](https://media.mailhop.org/duocircle/images/2016/03/spf-record-tester-4455.jpg)  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Phishing ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)
- [ ![Email-based Ransomware Attacks](https://media.mailhop.org/duocircle/images/2018/02/email-smtp-service-7834.jpg)  7 Ways to Protect Your Organization from Email-based Ransomware Attacks Phishing ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

## Related Articles

[  Phishing 11m  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough  Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[  Phishing 5m  10 Applications of ChatGPT that Hackers Are Already Exploiting  May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[  Phishing 4m  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks  Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[  Phishing 9m  7 Ways to Protect Your Organization from Email-based Ransomware Attacks  Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"The Number One Clue to a Phishing Email (and what to do about it)","description":"If you take an email security awareness training class, you’ll learn a dozen ways to spot phishing email. There are a lot of clues.","url":"https://www.duocircle.com/blog/phishing-protection/the-number-one-clue-to-a-phishing-email-and-what-to-do-about-it/","datePublished":"2020-07-29T21:10:21.000Z","dateModified":"2025-05-27T13:58:18.000Z","dateCreated":"2020-07-29T21:10:21.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/the-number-one-clue-to-a-phishing-email-and-what-to-do-about-it/"},"articleSection":"phishing-protection","keywords":"","wordCount":516,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/07/hosted-email-server-8711.jpg","caption":"phishing email","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"The Number One Clue to a Phishing Email (and what to do about it)","item":"https://www.duocircle.com/blog/phishing-protection/the-number-one-clue-to-a-phishing-email-and-what-to-do-about-it/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"The Number One Clue to a Phishing Email (and what to do about it)","item":"https://www.duocircle.com/blog/phishing-protection/the-number-one-clue-to-a-phishing-email-and-what-to-do-about-it/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"The Number One Clue to a Phishing Email (and what to do about it)","description":"If you take an email security awareness training class, you’ll learn a dozen ways to spot phishing email. There are a lot of clues.","url":"https://www.duocircle.com/blog/phishing-protection/the-number-one-clue-to-a-phishing-email-and-what-to-do-about-it/","datePublished":"2020-07-29T21:10:21.000Z","dateModified":"2025-05-27T13:58:18.000Z","dateCreated":"2020-07-29T21:10:21.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/the-number-one-clue-to-a-phishing-email-and-what-to-do-about-it/"},"articleSection":"phishing-protection","keywords":"","wordCount":516,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/07/hosted-email-server-8711.jpg","caption":"phishing email","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```