In short
LocalInbox checks every message for phishing on your Mac and shows a warning that says why in plain words: a look-alike address, a sender that failed SPF, DKIM or DMARC, a link that shows one address and goes to another, or pressure to sign in or pay. Delete and Block is one click away, and suspected phishing never sends a notification.
What it checks
- Look-alike sender addresses and domains.
- SPF, DKIM and DMARC results. Mail that passes all three shows a shield next to the sender.
- Links whose text shows one address while the link goes to another.
- Pressure to sign in or pay.
- With Apple Intelligence, the on-device model gives a second opinion on suspected phishing.
What happens to suspected phishing
- A warning above the message with the reasons, and Delete and Block.
- No summary and no suggested replies.
- No notification.
- Company logos never show on it.
Tracking protection too
Remote images wait until you allow them, per message or per sender. Tracking pixels are removed and tracking parameters are cut from links. Message HTML runs with JavaScript off.
Questions
Does LocalInbox send my mail to a scanning service?
No. Every check runs on your Mac, using the message and the authentication results your mail server already added.