How to See the Real Address Behind a Display Name in Gmail

A message says it is from your bank or your manager, but something feels off and the name in the inbox tells you nothing. Gmail shows the display name the sender typed, and anyone can type any name. The address behind it, and who actually sent it, take one more click.

Hover over or expand the sender name on the web

Open the message. Hover over the sender's name at the top and a card appears with the email address. For more, click the small down arrow next to to me under the name. The expanded box shows from, to, date, and, for most mail, mailed-by, signed-by, and a security line.

Tap the sender name in the phone app

In the Gmail app, open the message and tap the sender's name to see the address. Tap the arrow beside the recipient line to see the full from, to, and date details.

Open Show original for the full headers

Click the three-dot menu on the message and choose Show original. A new tab shows the message details at the top, including the From address, SPF, DKIM, and DMARC results, each marked PASS or FAIL. Further down, the raw headers include Return-Path, which is where bounces would go and often exposes the real sending account.

Compare the domain to the one you expect

A display name that says a bank with an address at a free mail provider or a random domain is a spoof. Look for domains that are one letter off, extra words before the real name, and a mailed-by or signed-by domain that has nothing to do with the sender. A FAIL on DMARC for a well-known company is a strong warning sign.

To see everything from that address, search from: followed by the exact address.

If you think it is phishing. Do not reply to ask if it is real, and do not use a phone number from the message; call a number you already have. Open the three-dot menu and choose Report phishing so Gmail blocks it for others.

If mailed-by shows an unfamiliar service. Legitimate companies send newsletters and receipts through bulk mail providers, so a different mailed-by domain alone is not proof. The address and the DMARC result matter more.