An authenticated email is an email that came from where it claims. It is not a truthful email. Most of the industry conflates the two, and recruitment fraud lives in that gap.
On 2 September I received an approach for a Group CTO role at an aviation group. The message was short, correct and specific: it named three real projects from my career. Google delivered it to the primary inbox with SPF, DKIM and DMARC all green.
Five checks later it was clear there was no company behind it. What follows is the procedure, not the anecdote.
1. Ask how old it is, not how good it looks
RDAP replaced WHOIS and answers in JSON. It is the first query, always, because fraud needs disposable domains and disposable domains are new.
The sender’s domain had been registered on 29 August 2026 at 14:43:26 UTC, through Hostinger, for one year, with the registrant hidden. The email arrived four days later. An executive search firm with an aviation client book is not four days old.
2. The certificate dates the build
Every public TLS certificate is recorded in the Certificate Transparency logs, and the notBefore field says when it was issued. Let’s Encrypt backdates it by one hour, so add that hour back.
With that correction, the certificate was issued roughly three minutes after the domain was registered. Domain, DNS, mailbox and certificate in one automated pass. Nobody designed anything: the sender just had to exist.
3. Look at the website, not the logo
The website was the hosting provider’s default parking page. No company name, no address, no phone, no team, no published mandate. The email, meanwhile, spoke of a confidential executive search.
A headhunter with no website is a headhunter with no clients. Nobody hands a CTO search to a firm that cannot show who it is.
4. Any live site leaves a trace
urlscan.io has archived every scan anyone has requested since 2016. The Wayback Machine has been capturing since 1996. A real corporate domain accumulates a trail in both almost by accident: a client checking it, a mail filter scanning it, a crawler passing through.
This one had zero scans and zero captures. That is not a company with a small digital footprint. That is a domain nobody has ever visited.
5. Check whether the message holds together
Four inconsistencies, all visible in the email itself:
- The signature claimed a job title at a large US staffing firm. The title is real and belongs to a real person, findable on LinkedIn. But an employee of that firm writes from that firm’s domain.
- The emails were timestamped
+0100. The firm named is headquartered on the US East Coast,−0400. - They wrote to my personal Gmail, not the professional address I publish on my site and my CV. It came from a list.
- The follow-up arrived 22 hours later and opened with “Hi There”. It had lost my name along the way: that is an automated sequence, not a person interested in a candidate.
The commands
Four queries, no account, no paid tooling. Replace DOMAIN:
curl -s https://rdap.org/domain/DOMAIN | jq '.events'
echo | openssl s_client -connect DOMAIN:443 | openssl x509 -noout -issuer -dates
dig +short MX DOMAIN && dig +short TXT _dmarc.DOMAIN
curl -s "https://urlscan.io/api/v1/search/?q=page.domain:DOMAIN"
What authentication actually proves
SPF, DKIM and DMARC answer one question: is this server authorised to send on behalf of this domain? If you own the domain, the answer is yes. Authenticating is trivial — fifteen minutes and the price of a domain.
The question that matters — does the company in this email exist? — is answered by no header. It is answered by the domain registry, the transparency logs and the public trail. And anyone can ask it.
On the person being impersonated
The name and title in that signature belong to a real professional who almost certainly knows nothing about this. She is the first person harmed here, not the author. I am publishing the domain — bonillarecruiting.com — and not the name, because the domain is the verifiable fact and the name is only the costume.
Why it works
The technical part is the easy part. Five minutes, four commands, no judgement call.
The hard part is the rest. This works because it reaches someone with twenty years of craft whom nobody has called in months. Because the email says, in your own words, that what you built matters. Because when you have been waiting a long time for a signal, you do not audit the first one that arrives. You are grateful for it.
That is the material these operations work with. Not cheap domains and automated certificates, but the hope of capable people who only wanted to work again. The check costs nothing. Run it before you let yourself hope, not after.