Verify your interview progress

How it works

1. 1

   Upload the original email

   Save the email as a file from your mail app — in Gmail, open it and choose ⋮ → Download message; in Apple Mail, File → Save As with Raw Message Source; in Outlook on the web, ⋯ → Download. It has to be the original, not a forward.

2. 2

   We check the company's signature

   Every company's mail server signs the emails it sends. We look up that company's public key and check the signature against the email: change even one character and it no longer matches. We also check the signature belongs to the company in the From: address, so nobody can sign on another company's behalf.

3. 3

   We read what happened

   Once it's proven genuine, we read what the email says — an invitation, a scheduled interview, an outcome — and which stage it was. Each entry quotes the sentence it's based on, word for word, and anything we're unsure of is left out rather than guessed.

4. 4

   You share a link

   Your profile lists every verified email, grouped by company. Your email address stays masked. Give each application its own link and you'll see whether it was opened.

The cryptography, if you want to check

Nothing is encrypted here — what we rely on is a digital signature. The standard is called DKIM: a company's mail server signs a hash of the email with its private key, and publishes the matching public key in DNS, where anyone can look it up. A signature that verifies proves two things: the email came from that company's servers, and it hasn't been changed since.

This is also why a forwarded email can't be verified: forwarding rewrites the message, so the original signature no longer matches.

• DomainKeys Identified Mail (DKIM) — the email-signing standard we verify
• Digital signature — how a signature proves who sent something and that it's unchanged
• Public-key cryptography — why a public key can check a signature without being able to forge one
• RSA — the signature algorithm most companies' mail servers use
• SHA-256 — the hash that ties the signature to the email's exact contents
• DMARC — the rule that the signing domain must match the sender's — we apply a stricter version of it