Outlook on Windows (classic)
- Select the suspicious email in your inbox.
- Press Ctrl+Alt+F, or choose More Respond Actions, then Forward as Attachment.
- Send it to check@isitlegit.co.za.
How it works
How does IsItLegit check an email?
Forward it as an attachment to check@isitlegit.co.za. We run checks and four Meta models over it, and you get a verdict by email with the evidence behind every reason.
Sign up first: we answer mail from the address or domain you verify.
By Derick Payne, Rizonetech · Reviewed 31 Oct 2026
You forward the email as an attachment
Sign up first: we answer mail from the address or domain you verify.
We investigate the sender, links, attachments and pictures
You get safe, suspicious or malicious, with proof
Why forward as an attachment?
A normal forward throws away the original headers, and the headers are where your own mail server recorded whether the sender is who they claim. Forwarding as an attachment keeps them. A normal forward is still checked, but without the original's headers the sender checks cannot run, and the reply tells you so.
New Outlook and Outlook on the web
- Start a new message and open it in its own window.
- Drag the suspicious email from your inbox into the new message until you see "Drop messages here".
- Send it to check@isitlegit.co.za.
Using only a keyboard? Forward the email normally: Ctrl+F in new Outlook, or Shift+F on the web when Settings, General, Accessibility, Keyboard shortcuts is set to Outlook (press Shift+?to see your set), or Tab to the Forward button. It is still checked, without the sender checks.
Microsoft: Add pictures or attach files to emails in OutlookGmail on a computer
- Tick the email in your inbox list.
- Choose More, then Forward as attachment.
- Send it to check@isitlegit.co.za.
Or save it to upload: open the email, choose More, then Download message, and upload the .eml file.
The Gmail phone apps do not offer either, so use a computer.
Google: Forward emails as attachments in GmailWe answer only mail sent from a member's verified address or domain. Anything else gets no reply, so the address cannot be used to send spam. Once you sign in you can also upload an .eml or .msg file, a PDF or a voice note.
What happens to the email?
Every step produces a piece of evidence, and the verdict may only cite evidence that exists.
Who really sent it
SPF, DKIM and DMARC as recorded by your own mail server, display name tricks, a different Reply-To, and whether anyone at your business has checked mail from this sender with us before.
Attachments and hidden text
Files pretending to be something else, HTML smuggling, macros, and words hidden from you but aimed at AI filters. An honest sender has no reason to hide words from the reader.
Reads it the way you see it
The email, its PDFs and its landing pages are rendered as pictures. Muse Spark says which brand it claims to be, what it wants you to do and how hard it pushes.
Walks the link for you
In a sealed browser, Muse Wonder clicks through the lure the way a victim would and types made-up test values, never real ones, to show where a password would have gone.
Listens to voice notes
Muse Voice Transcribe turns a voice note into text, then Muse Spark pulls out the request and who the caller claims to be. It supports English but not Afrikaans, isiZulu or isiXhosa yet, and we do not claim to detect voice cloning.
Weighs it and cites the proof
Muse Spark weighs all the evidence and writes the verdict. A changed bank account or a password form on a lookalike domain sets a floor the model cannot talk down.
When a check cannot finish
- A forward without the original's headers is checked without the sender checks, and the reply says so.
- If we cannot read the message you forwarded, you get no verdict and the reply asks you to forward it again as an attachment.
- If a check cannot finish, you get no verdict yet and the reply asks you to forward it again later.
- We can check a message of up to 25 MB, by mail or upload. A bigger one is refused with "Message too large" and no verdict. Gmail turns attachments over 25 MB into Google Drive links, which we cannot open.
Until it is checked, do not pay, click or reply.
Your questions
What do you get back?
A reply to your forward with the verdict, the top three reasons and what to do now, plus a link to the full report. Report links are signed and expire after 7 days.
How long do we keep it?
The email and its attachments are deleted after 30 days. The case summary and evidence stay so your history keeps working.
Privacy and POPIADoes Meta keep my mail?
We call Meta's Model API with standard model IDs and store: false on every request, and never in the mode that allows training on what we send.
I checked this in our own code on 31 October 2026.
Got one in your inbox right now? Forward it.
Free during launch. Members join with an invite code.