diff --git a/FAQ.md b/FAQ.md
index 1bf0e2000a..b444d0151d 100644
--- a/FAQ.md
+++ b/FAQ.md
@@ -2422,6 +2422,9 @@ You can enable/disable [authentication verification](https://en.wikipedia.org/wi
 FairEmail can show a warning flag too if the domain name of the (reply) email address of the sender does not define an MX record pointing to an email server.
 This can be enabled in the receive settings. Be aware that this will slow down synchronization of messages significantly.
 
+If the domain name of the sender and the domain name of the reply address differ,
+always a warning flag will be shown because this is most often the case with phishing messages.
+
 If legitimate messages are failing authentication, you should notify the sender because this will result in a high risk of messages ending up in the spam folder.
 Moreover, without proper authentication there is a risk the sender will be impersonated.
 The sender might use [this tool](https://www.mail-tester.com/) to check authentication and other things.