---
title: "Make your mail hard to fake · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/email-security/phishing-resistance
updated: 2026-10-20
licence: "All rights reserved"
---

# Make your mail hard to fake

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Email security](https://agentwranglers.se/playbook/email/email-security)
- Rule: Never ask for a password, code or payment detail by email. Send from the same domains and addresses every time, so fakes stand out.
- How: Tell people in your emails and help pages that you never ask for passwords by email. Keep one sender address per kind of mail. Watch for lookalike domains, for example with certificate transparency alerts, and report them. Strong authentication makes exact copies fail (see [DMARC](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)).
- Check: Search your email templates for "password", "PIN" and "card number" in requests. None asks the reader to send one.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/phishing-resistance`.

- Previous: [Send only links people can trust](https://agentwranglers.se/playbook/email/email-security/safe-links)
- Next: [Make sign-in and reset links single-use and short-lived](https://agentwranglers.se/playbook/email/email-security/sign-in-links)
- [Email security](https://agentwranglers.se/playbook/email/email-security)