Checking activity on a gmail account

Gmail makes it easy to check activity on your account. At the bottom right of the inbox screen, you'll see a link for Details below a caption indicating when the last activity in the account occurred.

If you click on this link, a new window will open listing the access dates and times the account was logged into, the location and IP address from where the login took place, and whether the login was from a PC, mobile device or email account.

Check to see if a hacker is forwarding your gmails

Under Settings in Gmail (click on the cog icon on the upper right) there's tab entitled, "Forwarding and POP/IMAP". The first section named, 'Forwarding" allows users to add email addresses they want their gmails to be forwarded to. If your account has been hacked, you may find an unfamiliar address listed there.

DMARC Email Authentication

American government agencies are currently rushing to meet the January 15, 2018 deadline for implementing the DMARC protocol. DMARC stands for Domain Message Authentication, Reporting and Conformance. It's a security protocol that allows for reporting between email receivers and senders in order to discourage spoofing - sending fraudulent emails which appear to come from a legitimate domain as means of facilitating spam and phishing.

DMARC was developed in the private sphere and came into widespread use in 2012. The authentication process allows a receiver to check if a message comports with what is knows about a sender. The owner of a domain uses either a DomainKey Identified Mail (DKIM) or Sender Policy Framework (SPF) mechanism. The receiver must confirm that the header of a new message aligns using DKIM or SPF with authenticated domain names.

You can confirm with if a domain is using DMARC on this site. It will determine if the domain has a DMARC policy in place:

. . . and also provide an overall DMARC score.