---
title: "Check a Recruiter's E-mail: Real Domain or Fake?"
description: "Paste a recruiter's e-mail address, From line or link. The checker flags free e-mail, look-alike domains and borrowed names, right in your browser."
lang: en
canonical: "https://kariraman.com/en/tools/check-recruiter-email/"
dateModified: "2026-10-08"
sources:
  - "https://ekonomi.republika.co.id/berita/sq0416423/ini-5-ciriciri-lowongan-kerja-palsu-versi-kemnaker"
  - "https://www.pertamina.com/waspada-penipuan"
  - "https://www.bankmandiri.co.id/web/guest/mandiri-career"
  - "https://e-recruitment.bri.co.id/"
  - "https://www.rfc-editor.org/rfc/rfc9989.html"
  - "https://www.unicode.org/reports/tr39/"
  - "https://www.rfc-editor.org/rfc/rfc5890.html"
  - "https://career.indomaretgroup.com/"
  - "https://career.garuda-indonesia.com/faq"
  - "https://bumn.go.id/peluang/karir/karir-bumn"
  - "https://karier.kai.id/"
  - "https://pandi.id/public/files/2024/10/kebijakan-pendaftaran-nama-domain-versi-9-0-bilingual-new-1729151599.pdf"
  - "https://sscasn.bkn.go.id/"
  - "https://penerimaan.polri.go.id/"
  - "https://rekrutmen-tni.mil.id/landing-page"
  - "https://www.rfc-editor.org/rfc/rfc3986.html"
  - "https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026"
---

> Markdown version of https://kariraman.com/en/tools/check-recruiter-email/. Cite that HTML page and its update date.

# Check a recruiter's e-mail or link before you reply

Paste the sender's e-mail address, the full From line, or the registration link. The checker compares it with the official domains on the Official Recruitment list and shows the warning signs it finds.

**The text you paste is not sent anywhere and is not stored.**

## Which address do you want to check?

## What should you do next?

- **[Official Recruitment list](https://kariraman.com/en/official-recruitment/)** Careers sites, e-mail domains and official accounts of often-impersonated companies and agencies.
- **[Check the company](https://kariraman.com/en/job-scams/verify-an-employer/)** Search the legal name on AHU and match it with the company's official site.
- **[Check the ad itself](https://kariraman.com/en/check-a-job/)** Paste the vacancy text into the job-ad checker to see other warning signs, such as requests for fees.
- **[Report it](https://kariraman.com/en/job-scams/report/)** Report a fake vacancy to an official channel, especially if you were asked for money or personal data.

## How can you check a recruiter's address without this tool?

Without JavaScript, or if you prefer to check yourself, use this list. Each item is a sign the tool looks for.

1. Medium sign **Uses free e-mail** Kemnaker lists e-mail on public domains such as gmail as a sign of a fake vacancy. Pertamina and Bank Mandiri also tell applicants to ignore invitations not sent from the company's official e-mail. Some legitimate small businesses do use free e-mail, so check other official sources. **Next step:** Find the company's official site yourself and apply through the channel listed there. **Sources:** - [Republika](https://ekonomi.republika.co.id/berita/sq0416423/ini-5-ciriciri-lowongan-kerja-palsu-versi-kemnaker) (official statement via media) 7 October 2026 - [PT Pertamina (Persero)](https://www.pertamina.com/waspada-penipuan) 8 October 2026 - [PT Bank Mandiri (Persero) Tbk](https://www.bankmandiri.co.id/web/guest/mandiri-career) 8 October 2026
2. Strong sign **Free e-mail claiming to be a large company or agency** The sender name or address uses the name of a company or agency on our list, but the domain is free e-mail. The organisations on this list publish their own official domains, and several tell applicants plainly to ignore e-mail from outside them. **Next step:** Do not reply or send any data. Open the official careers site from the Official Recruitment list and check whether the vacancy exists. **Sources:** - [PT Bank Mandiri (Persero) Tbk](https://www.bankmandiri.co.id/web/guest/mandiri-career) 8 October 2026 - [PT Bank Rakyat Indonesia (Persero) Tbk](https://e-recruitment.bri.co.id/) 8 October 2026 - [PT Pertamina (Persero)](https://www.pertamina.com/waspada-penipuan) 8 October 2026
3. Strong sign **Domain looks like an official domain** This domain differs by one or two letters from an official domain, or matches it with a hyphen added or removed. The DMARC e-mail standard (RFC 9989) says it does not address visually similar domain names, so e-mail from a look-alike domain can still reach your inbox. **Next step:** Compare letter by letter with the official domain on the Official Recruitment list. Do not click links in that e-mail. **Sources:** - [Internet Engineering Task Force (IETF)](https://www.rfc-editor.org/rfc/rfc9989.html) 8 October 2026 - [PT Bank Mandiri (Persero) Tbk](https://www.bankmandiri.co.id/web/guest/mandiri-career) 8 October 2026 - [PT Bank Rakyat Indonesia (Persero) Tbk](https://e-recruitment.bri.co.id/) 8 October 2026
4. Strong sign **Uses look-alike characters** This domain contains non-Latin letters, punycode (starting with xn--), or digits standing in for letters, such as 0 for o. Unicode explains that letters from different scripts can look identical, and IDNA writes such names as xn-- labels in the DNS. **Next step:** Type the official site address yourself instead of copying it from the message. Delete the e-mail if it asks for data or money. **Sources:** - [Unicode Consortium](https://www.unicode.org/reports/tr39/) 8 October 2026 - [Internet Engineering Task Force (IETF)](https://www.rfc-editor.org/rfc/rfc5890.html) 8 October 2026
5. Strong sign **Company name placed on another domain** The company's name or official domain appears at the front, in a subdomain, or in the link path after a slash, but the real domain belongs to someone else, or the name is joined to words such as rekrutmen or karir on a domain that is not official. Several companies on this list say official recruitment information is only on their own sites and e-mail. **Next step:** Look at the real domain in the result. That is who owns this address, not the name in front of it. **Sources:** - [PT Bank Rakyat Indonesia (Persero) Tbk](https://e-recruitment.bri.co.id/) 8 October 2026 - [Indomaret Group (PT Indomarco Prismatama)](https://career.indomaretgroup.com/) 8 October 2026 - [PT Garuda Indonesia (Persero) Tbk](https://career.garuda-indonesia.com/faq) 8 October 2026
6. Medium sign **Domain or link contains a listed company's name** This domain, or the link path, contains the name of a company on our list, but the domain is not on that company's list of official domains. It may be a legitimate subsidiary, partner or news site, or it may be an imitation. **Next step:** Check whether the company's official site mentions this domain before you send any data. **Sources:** - [Badan Pengaturan BUMN](https://bumn.go.id/peluang/karir/karir-bumn) 8 October 2026 - [Internet Engineering Task Force (IETF)](https://www.rfc-editor.org/rfc/rfc9989.html) 8 October 2026
7. Medium sign **Recruitment words in an unknown domain** This domain uses words such as rekrutmen, karir, loker or hrd. Large companies on our list recruit from their own domains, and several say official vacancies are only on their careers sites. A domain with recruitment words is not always fake, but it needs checking. **Next step:** Look up the company on AHU and its official site, then match the domain. **Sources:** - [Indomaret Group (PT Indomarco Prismatama)](https://career.indomaretgroup.com/) 8 October 2026 - [PT Garuda Indonesia (Persero) Tbk](https://career.garuda-indonesia.com/faq) 8 October 2026 - [PT Kereta Api Indonesia (Persero)](https://karier.kai.id/) 8 October 2026
8. Strong sign **Claims to be a government body without a government domain** This address names a government body or selection, such as CPNS, Polri or TNI, but its domain is not go.id or mil.id. Under PANDI's policy, go.id names are governed by a ministerial regulation and mil.id by the TNI Commander, so registering them follows special government rules. **Next step:** CPNS and PPPK selection runs on sscasn.bkn.go.id, Polri on penerimaan.polri.go.id, and TNI on rekrutmen-tni.mil.id. **Sources:** - [Pengelola Nama Domain Internet Indonesia (PANDI)](https://pandi.id/public/files/2024/10/kebijakan-pendaftaran-nama-domain-versi-9-0-bilingual-new-1729151599.pdf) 8 October 2026 - [Badan Kepegawaian Negara](https://sscasn.bkn.go.id/) 8 October 2026 - [Kepolisian Negara Republik Indonesia](https://penerimaan.polri.go.id/) 8 October 2026 - [Tentara Nasional Indonesia (Pusminpers TNI)](https://rekrutmen-tni.mil.id/landing-page) 8 October 2026
9. Mild sign **Domain ending meant for individuals or the public** This domain ends in my.id, web.id or biz.id. Under PANDI's policy those endings are for individuals, the general public or small businesses, while co.id is for business entities with an NIB. Legitimate small businesses may use them, but large companies usually do not. **Next step:** Match it against the company's official site. Do not send personal documents until you are sure. **Sources:** - [Pengelola Nama Domain Internet Indonesia (PANDI)](https://pandi.id/public/files/2024/10/kebijakan-pendaftaran-nama-domain-versi-9-0-bilingual-new-1729151599.pdf) 8 October 2026
10. Strong sign **Sender name or mailbox name contains another address** The sender's display name, or the mailbox name before the @ sign, contains an address or domain different from the real e-mail domain. The domain's owner can set both freely, and the DMARC standard (RFC 9989) says it does not address abuse of the display name. **Next step:** Look at the domain after the @ sign, not the name or words in front of it. **Sources:** - [Internet Engineering Task Force (IETF)](https://www.rfc-editor.org/rfc/rfc9989.html) 8 October 2026
11. Medium sign **Sender name or mailbox name uses an organisation's name, the domain does not** The display name, or the mailbox name before the @ sign, names a company or agency on our list, but the address domain is not on its list of official domains. Anyone can set a display name, and a domain's owner can create any mailbox name before the @ sign. **Next step:** Trust the address domain, not the displayed name. Check that domain on the Official Recruitment list. **Sources:** - [Internet Engineering Task Force (IETF)](https://www.rfc-editor.org/rfc/rfc9989.html) 8 October 2026
12. Medium sign **Short link, generic form or free website** This address uses a link shortener, a generic form builder or a free website service. Companies on our list say applications go only through their official careers sites, for example Garuda Indonesia and KAI. **Next step:** Do not fill in that form. Register directly on the official careers site. **Sources:** - [PT Garuda Indonesia (Persero) Tbk](https://career.garuda-indonesia.com/faq) 8 October 2026 - [PT Kereta Api Indonesia (Persero)](https://karier.kai.id/) 8 October 2026 - [Indomaret Group (PT Indomarco Prismatama)](https://career.indomaretgroup.com/) 8 October 2026
13. Strong sign **Link hides its real domain** This link puts text before an @ sign in the address part, so the real destination hides behind it. The URI standard (RFC 3986) says this can be used to mislead readers. **Next step:** Do not open this link. Look at the real domain in the result. **Sources:** - [Internet Engineering Task Force (IETF)](https://www.rfc-editor.org/rfc/rfc3986.html) 8 October 2026
14. Medium sign **Same name as an official domain, different ending** This domain has the same name as an official domain on our list but a different ending, for example .com instead of .co.id. A domain like this may belong to the same organisation, to another legitimate owner, or to an imitator. Other domains we have confirmed are used by an organisation on this list do not trigger this sign. Bank Mandiri and BRI ask applicants to make sure e-mail comes from their official domains. **Next step:** Check whether the organisation's official site mentions this domain. Until it is clear, do not send data or money. **Sources:** - [PT Bank Mandiri (Persero) Tbk](https://www.bankmandiri.co.id/web/guest/mandiri-career) 8 October 2026 - [PT Bank Rakyat Indonesia (Persero) Tbk](https://e-recruitment.bri.co.id/) 8 October 2026 - [Internet Engineering Task Force (IETF)](https://www.rfc-editor.org/rfc/rfc9989.html) 8 October 2026
15. Mild sign **Domain ending often used for phishing** This ending is one of the twenty endings with the highest phishing score in Interisle's data for May 2025 to April 2026, which compares the number of phishing domains with the number of registered domains. Many legitimate sites use these endings too, so this is only a mild sign. **Next step:** Match this domain against the organisation's official site before you fill in a form or send documents. **Sources:** - [Interisle Consulting Group (Cybercrime Information Center)](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) 8 October 2026

## How does this tool check a recruiter's address?

The tool finds the real domain, then compares it with the official domains on the Official Recruitment list. It flags free e-mail, domains that differ by one or two letters or use another ending, look-alike characters, company names placed on other domains or in the link path, misleading display names and mailbox names, short links, domain endings often used for phishing, and government bodies without a go.id or mil.id domain.

[Official Recruitment list](https://kariraman.com/en/official-recruitment/)

## What can this tool not check?

The tool does not read the content or headers of an e-mail, so it cannot confirm that a message really came from the company's servers. It does not yet check when a domain was registered. Our list also covers only organisations whose names are often misused. A result with no warning signs does not mean the address is genuine.

**KarirAman is 100% free. We never ask for money.**

For job seekers and employers. We run no ads, sell no data and never ask for any fee. Anyone asking for money in KarirAman's name is a scammer. [Our no-fee policy](https://kariraman.com/en/no-fees/)

## Sources

The facts on this page come from these sources. Dates show when we opened them.

1. [Ini 5 ciri-ciri lowongan kerja palsu versi Kemnaker](https://ekonomi.republika.co.id/berita/sq0416423/ini-5-ciriciri-lowongan-kerja-palsu-versi-kemnaker) Republika · official statement via media · accessed 7 October 2026
2. [Waspada Penipuan | PT Pertamina (Persero)](https://www.pertamina.com/waspada-penipuan) PT Pertamina (Persero) · accessed 8 October 2026
3. [Mandiri Career | Bank Mandiri](https://www.bankmandiri.co.id/web/guest/mandiri-career) PT Bank Mandiri (Persero) Tbk · accessed 8 October 2026
4. [E-Recruitment BRI](https://e-recruitment.bri.co.id/) PT Bank Rakyat Indonesia (Persero) Tbk · accessed 8 October 2026
5. [RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989.html) Internet Engineering Task Force (IETF) · accessed 8 October 2026
6. [Unicode Technical Standard #39: Unicode Security Mechanisms](https://www.unicode.org/reports/tr39/) Unicode Consortium · accessed 8 October 2026
7. [RFC 5890: Internationalized Domain Names for Applications (IDNA): Definitions and Document Framework](https://www.rfc-editor.org/rfc/rfc5890.html) Internet Engineering Task Force (IETF) · accessed 8 October 2026
8. [Career Indomaret Group](https://career.indomaretgroup.com/) Indomaret Group (PT Indomarco Prismatama) · accessed 8 October 2026
9. [Career Garuda Indonesia: FAQ](https://career.garuda-indonesia.com/faq) PT Garuda Indonesia (Persero) Tbk · accessed 8 October 2026
10. [Karir dan Magang BUMN | Badan Pengaturan BUMN](https://bumn.go.id/peluang/karir/karir-bumn) Badan Pengaturan BUMN · accessed 8 October 2026
11. [Karier KAI Group](https://karier.kai.id/) PT Kereta Api Indonesia (Persero) · accessed 8 October 2026
12. [Kebijakan Pendaftaran Nama Domain versi 9.0 (PANDI)](https://pandi.id/public/files/2024/10/kebijakan-pendaftaran-nama-domain-versi-9-0-bilingual-new-1729151599.pdf) Pengelola Nama Domain Internet Indonesia (PANDI) · accessed 8 October 2026
13. [SSCASN: Sistem Seleksi Calon Aparatur Sipil Negara](https://sscasn.bkn.go.id/) Badan Kepegawaian Negara · accessed 8 October 2026
14. [Penerimaan Anggota Polri](https://penerimaan.polri.go.id/) Kepolisian Negara Republik Indonesia · accessed 8 October 2026
15. [Rekrutmen TNI: Website Resmi Calon Prajurit TNI](https://rekrutmen-tni.mil.id/landing-page) Tentara Nasional Indonesia (Pusminpers TNI) · accessed 8 October 2026
16. [RFC 3986: Uniform Resource Identifier (URI): Generic Syntax](https://www.rfc-editor.org/rfc/rfc3986.html) Internet Engineering Task Force (IETF) · accessed 8 October 2026
17. [Phishing Activity in Top-level Domains (TLDs) May 1, 2025 - April 30, 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) Interisle Consulting Group (Cybercrime Information Center) · accessed 8 October 2026