How to verify recruiter email before you reply

# How to verify recruiter email before you reply

You can verify recruiter email before you reply, and the check starts with the address itself. A fake recruiter message can look real. The display name may match a recruiter at a company you know. The signature may carry the right logo. The reply-to address is where the message falls apart.

Before you share a resume or a phone number, run the email through the checks below.

Start with the domain, not the display name

The display name is not the address. A sender can put any display name over an address. The part that matters sits after the @. Compare it to the company's real website domain. In the scams we flag, the sender almost always uses a lookalike domain or a free mail account. In the reports we have reviewed, legitimate recruiting mail came from the company's primary domain or a known careers subdomain. A mismatch is a starting filter, not a verdict.

Example: a real company domain is northwind.com. The email arrives from sarah.chen@northwind-careers.com. The extra word "careers" changes the domain. That address is not from northwind.com. A company may use a separate careers domain, so a mismatch is not proof by itself. It is a reason to check further.

Search the company's official recruiter roster

The next step is to confirm the person exists. Do not ask the sender. Ask the company. Use the company website, not the email signature, to find their careers page or recruiter directory. Check whether the company publishes a verified roster of real recruiters. If the name does not appear there, treat the message as unverified.

In a recent report we reviewed, a candidate received a note from someone claiming to be a senior recruiter at a large tech company. The email signature listed a real office address and a real logo. The sender's domain was close but not exact. The company's published roster had no recruiter by that name. The candidate did not reply.

Check the email header path

If the address looks plausible, check the headers. In Gmail, open the message and choose "Show original". In Outlook, open message properties. Look at the first "Received" line and the authentication fields. In the reports we have reviewed, legitimate company mail passed SPF and DKIM for the company's domain. If the mail came from a consumer mailbox or a domain registered days ago, that is a red flag.

You do not need to be a security analyst. You only need to see whether the sending domain matches the company and whether the message passed common authentication checks. When those checks fail, the email cannot be treated as company mail.

Use a verification tool for the final check

A domain check and a roster search are the first two filters. A verification tool closes the gap. It checks whether an email address belongs to a verified recruiter at the company. If the tool returns NOT ISSUED, the address is not on the company's verified list. That verdict gives you a clear reason to stop replying.

This matters before any message with personal data. A fake recruiter email can lead to a request for a passport photo, a bank account for "direct deposit setup," or an onboarding fee. A real recruiter is paid by the employer, so one asking you for money cannot be legitimate. The first wrong reply is where the harm starts.

What to do after you check

If the email does not match the company domain, does not match a published recruiter, or fails a verification check, do not respond. Forward it to the company's abuse or security contact using the address on their official website. Then block the sender.

If the email does match, reply through the company's official careers channel or the verified contact listed in the roster. That keeps the conversation inside the company's systems. In the reports we have reviewed, verified recruiters could point to the same job on the company site. If the person cannot, treat that as another signal.