4

I received this email from Apple Support in regards to a current support case; HOWEVER my last contact about the case was this past Monday and we (somewhat) resolved the issue. I received this email today (5/23/19) at 1am PST, which is definitely odd as Apple Support phone lines are off during that time. I contacted Apple Support on it but they couldnt confirm/deny that the email address is legitimate and it might have been a bug/glitch in their system during the time; I also checked my Apple ID online and nothing is out of the ordinary.

AppleSupport@email[.]apple.com

My main concern is if the "AppleSupport@email[.]apple.com" is a legitimate address that Apple uses to send these kind of emails when they couldn't reach you for a callback.

Can anyone help confirm the email's legitimacy?

| improve this question | |
  • I get those as well - it’s either a very well done fake or it’s legitimate. Sometimes a peer or supervisor wants to check in - especially on a case where the technician wasn’t sure they nailed it or there wasn’t a clear resolution. – bmike♦ May 23 '19 at 18:02
  • how can i use TextEdit to check the url in the future? is that different from hovering over the url itself? – no nope May 23 '19 at 18:11
  • 1
    Yes - hovering over the URL can still be spoofed in some cases. There is a way to have a link with one text in hover, that’s different than what happens when you click. You can copy the URL and paste it anywhere. Into google docs, into a notepad, into TextEdit, into notes.app. – bmike♦ May 23 '19 at 18:13
  • i had "copy link" and pasted the original text as is in TextEdit(ie: "Open your case" had the url in the text still); how would i go from there? – no nope May 23 '19 at 18:16
  • 1
    If you paste into a RTF document, it’s styled - you’d need to right click and get at the URL. If you paste in to a plain text document (shift - command - T) you should get the raw text paste. – bmike♦ May 23 '19 at 18:25
4

The two pieces of information that make this legitimate is the message ID is really from Apple and the SPF comes from 17.x.x.x network which is known to be Apple’s private portion of the internet. Lastly, the DKIM validates both the above - apple.com email comes from the source.

Original Message

additional information about the email sent shows this is legitimate, passes the advanced checks designed to stop blatant fraudulent emails.

This one was legitimate, but others that look alike could be scams - check the details is my advice.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .