Job Offer from a Gmail or Look-Alike Domain? Check the Sender, Not the Logo
A real company hires from its own domain. If a "recruiter's" email comes from a Gmail address, or from a domain that looks almost — but not quite — like the company's real one, you are not looking at a job offer. You are looking at an impersonation, and the domain is the tell. Logos can be copied in seconds. Signatures, letterheads, and job descriptions can be lifted from the real company's site word for word. The one thing a scammer cannot fake is actually being the company — and the sender's domain is where that shows.
This check takes minutes, requires no special tools, and catches a large share of job-offer scams before anything else goes wrong.
The two domain tricks scammers use
The free email address. The offer arrives from something like `recruitingmanager84@gmail.com`, sometimes with a professional signature naming a real company and a real HR title. Reasoning offered: "our system is down," "I'm a contractor," "this is my direct address." Real companies — even small ones — recruit from company email. A Gmail address attached to a corporate hiring process means the process is not corporate.
The look-alike domain. This is the more dangerous version, because it looks right at a glance. The real company is at `salesforce.com`; the email comes from `careers-salesforce.us`. The real domain is the company's name; the fake adds a word — "llc," "careers," "hr," "inc" — swaps a letter, changes the ending, or hyphenates. Everything else in the email can be perfect: the logo, the recruiter's real name copied from LinkedIn, even a real job title. The domain is the one detail they hope you won't compare letter by letter.
How to check the domain in five minutes
- Find the company's real domain yourself. Do not click links in the email. Type the company name into a search engine, go to its official website, and note the exact domain — every letter, and the ending (.com, .us, .io are different domains entirely).
- Compare, character by character. Put the sender's domain next to the real one. `company.com` and `company-careers.com` are not the same sender. `company.com` and `companny.com` are not either. Any difference at all means the email did not come from the company.
- Check whether the job exists on the real site. Go to the company's own careers page — reached through the real website you found yourself — and look for the role. A real opening is posted there. A scammer's opening is not.
- Reach out through the real site, not the email. If you want confirmation, contact the company through the phone number or contact form on its real website and ask whether they are hiring for the role and whether they contacted you. Never reply to the suspicious email to ask — you would be asking the scammer whether the scammer is real.
- Be suspicious of where the conversation moves. If the "recruiter" quickly pushes you from email into a chat app, or sends a last-minute meeting link to an unfamiliar page, that is the impersonation protecting itself. A real hiring process stays inside channels the company actually owns.
Why this check works when others don't
Everything else about a scam offer is theater — and theater is cheap. A scammer can present a convincing story, a polished PDF, a real employee's name and photo. What they cannot do is send email from a domain they do not own, post the job on a careers page they do not control, or answer the phone number on the real company's website. Checking the source means checking the things that cannot be costumed. That is why the domain — one short line in the email header most people never read closely — is the most honest part of any offer you receive.
Other sender red flags worth naming
- The reply-to address differs from the from address, and points somewhere unrelated.
- The recruiter's name in the signature does not match the name in the email address.
- The email creates urgency — respond today, the role is filling, don't contact the company directly "to avoid delays."
- Attachments or links arrive before any verified contact: an "offer letter," an "onboarding portal," a "meeting" that asks you to install or run something.
How careersteer.app helps
Doing this well, for every detail of an offer, takes time most job seekers don't have — and scammers count on the check being skipped. careersteer.app investigates the source of a job offer against checked, real data points — the domain behind the sender, the details inside the offer, the patterns it matches — and produces an evidence-based report that lays out what it found, plainly, before you reply.
Frequently Asked Questions
Can a real company send a job offer from a Gmail address?
Established companies do not — their hiring runs through their own domain, their HR systems, and their own people. The explanations offered for a free email address ("our system is down," "I'm an outside contractor," "this is my direct email") are standard parts of the impersonation. Treat any corporate job offer arriving from a free email service as unverified until the company itself, reached through its real website, confirms the person and the role.
The sender's domain is the company's name plus one extra word. Close enough?
No — and this is the most important comparison on this page. `company.com` and `company-careers.com` are entirely different domains owned by entirely different people. So are `company.com` and `companny.com`, or a .com swapped for a .us or .io. There is no "close enough" in a domain: any difference at all means the email did not come from the company.
The recruiter is a real employee — I found them on LinkedIn. Doesn't that make the offer real?
It makes the name real. Scammers copy names, photos, and job titles of actual employees precisely because you will check them and relax. What you verified is that a person with that name works there — not that the person emailing you is them. Contact that employee through the company's own website or switchboard if you want certainty, never through the contact details in the suspicious email.
My offer arrived from no-reply@appsheet.com. Is that the same problem?
It is a close cousin, and it has its own guide: the sender address genuinely belongs to a Google platform, which is exactly why it fools people — but the platform is not the employer. See Job Offer from no-reply@appsheet.com? for how that version works and how to find who is actually behind it.
How do I find a company's real careers page?
Start from a search engine, not from anything in the offer. Search the company name, open its official website from the results, and look for "Careers" or "Jobs" in its own navigation. If the role you were offered is not posted there, that is meaningful evidence on its own — real openings are listed publicly so the company can be seen to hire fairly.
What if the email came from the company's real domain but something still feels off?
Trust the feeling and verify harder. Check whether the role exists on the real careers page, and contact HR through the company's published number rather than by replying. Real-domain emails can occasionally come from compromised accounts or misconfigured systems, and a scam's remaining tells — a chat-app interview, an early request for documents or money — still apply. The domain check is the strongest single test, not the only one.
Offer look polished but the sender looks off? Check the source before you reply.
First scan free, no card required.
Run a free scan