Is That Email Really From Porkbun? How to Spot Fake Emails
Scammers send emails branded to look like ours. The wording changes over time. We have seen fake suspension notices, fake expiration warnings, fake failed payment alerts, and fake verification demands. We've put together some information showing you how to check the emails you receive from Porkbun to see if they're legit.
Quick Check
Do not click any link in the email. Open a new browser tab, type porkbun.com yourself, and log in. Anything that genuinely needs your attention is visible and actionable inside your account: a domain's real status appears in Domain Management, invoices and charges appear in your billing history, and any required verification appears in your account settings.
If your account looks normal, the email was fake and you can delete it.
This is the most reliable test we can give you, because you are checking the source instead of judging the message.
Things Porkbun will never do
- Ask for your password. Not by email, not on the phone, not ever.
- Ask for a two-factor code. Those are for you to type into porkbun.com only.
- Ask for a full card number by email.
- Suspend a domain simply because a renewal payment failed. If a renewal payment does not go through, the domain continues to move toward its normal expiration date. There is no separate suspension, and no fee to rescue it beforehand.
- Send email from anywhere other than @porkbun.com.
There is one payment-related exception to be aware of: if you dispute a Porkbun charge with your bank as a chargeback, we may suspend the affected domain while we sort it out. That is a real situation, but you would already know about it, because you are the one who filed the dispute.
Check the sender address, not the sender name
Any sender can set their display name to "Porkbun." What matters is the actual address. Our email always ends in @porkbun.com, for example support@porkbun.com, abuse@porkbun.com, messages@porkbun.com, or verify@porkbun.com.
Watch for lookalikes: a different domain entirely, a subdomain trick such as porkbun.com.example.net, or a misspelling such as porkbun-support.com. If the part before the @ sign in the email is from any domain other than "porkbun.com", the email is not from us.
Note
There is one other rare exception to this rule. If you have a domain that is being reviewed or suspended due to an Abuse report, you'll get an email from an address ending in "@reports.cleandns.space". You can always reach out to Porkbun to check the legitimacy of any emails you receive.
Some real Porkbun emails do ask you to confirm something
It's true! We do sent legitimate emails suggesting that you take an action, including renewal and expiration notices, invoices and payment receipts, security notices about logins or password changes, email verification codes, and registry-required contact or address verification. Some registries genuinely require you to confirm your contact details, and ignoring those and get your domain suspended.
So just because an email from Porkbun asks you to do something, it's not inherently a sign of it being fake. The rule that always holds is the one mentioned above: you never have to use the email's links. Log in to your account at porkbun.com directly and do the same thing from inside your account. If the request is real, you will find it there.
Reporting a fake
- Do not click anything in it.
- Forward it to support@porkbun.com. If your email program can attach the message as a .eml file, please do. That preserves the hidden headers we need to trace the sender.
- Delete it.
Nothing happens to your account just from receiving one. Reporting it helps us get the sending infrastructure shut down. We appreciate your assistance in making the internet a less annoying and malicious place!
If you already clicked and entered your password
Change your Porkbun password now, and we'd also recommend turning on two-factor authentication while you're at it. If you used that same password anywhere else, it's a good idea to change it there too. Then, reach out to support@porkbun.com to let us know, so we can review your account for unexpected changes such as new API keys, changed contact details, or transfers out.
If you entered card details
Contact your bank or card issuer right away, tell them the card was entered on a fraudulent site, and ask them to block or reissue it. Keep an eye on your statement for charges you don't recognize. We can't cancel a card for you, and whoever is behind the site has the number whether or not a charge has shown up yet.
If you have any questions or concerns, don't hesitate to get in touch with our Support team for assistance.