FlowMail 26.2 is on the App Store, and for the first time it is on iPhone and iPad as well as the Mac. It is the same app on all three, so one purchase covers every device you use it on. The release also adds two things you can do to any message: ask it whether it is what it claims to be, and read it in your own language.
Verify: ask a message who really sent it
Open a message and tap Verify in the toolbar. FlowMail reads what the message already contains and tells you, in plain words, what it found. It runs only when you tap it — never during sync, never in the background.
These are the patterns it looks for, each one a check with its own finding:
- Links that lie. A link that reads as one address and goes to another, one that imitates the sender’s domain by a single character, one that uses letters from another alphabet to look like a familiar name, a shortened link whose destination the message does not show, and a link that redirects somewhere else.
- Senders that do not add up. A sender’s name that reads as one domain while the address is another — the classic
"billing@supplier.com" <someone@gmail.com>— replies that would go to a different domain, and a message handed over by a different domain from the one it claims. - Conversations that changed hands. A reply to a message you never received, and a thread whose sender’s domain changed partway through, which is the shape of an invoice-fraud hijack.
- Attachments that are not what they say. A file that runs a program when opened, one whose name hides its real type, one described as a different kind of file, and document types that can carry macros.
- SPF, DKIM and DMARC, as the server that delivered the message reported them.
That last line is the one people over-trust. SPF, DKIM and DMARC are the checks mail servers run to confirm which domain a message came from. A pass proves the domain, not the person: a Gmail account asking you to send your supplier’s next payment somewhere new can pass all three. Business email compromise, the FBI’s name for scams like this, cost $3bn in reported losses in 2025.
Nothing the message points at is fetched to do this. No link is opened and no attachment is downloaded: the checks work from the addresses, headers and text already on your device, so a hostile message gets nothing back from being checked.
It never says “safe”
The answer comes as one of three headlines: Nothing unusual in these checks, Worth knowing before you act, or Signs this may not be from who it claims. None of them says a message is safe, because no set of checks can know that. The strongest thing Verify will say is that nothing it looked at stood out, which is a statement about the checks rather than the message. It is not antivirus and it does not scan for viruses, and the sheet says so.
Under the headline, Verify lists what it checked and what it could not. A result reached with no research server and no model is a narrower answer than one reached with both, and the sheet tells you which one you are looking at.
Two optional extras, both off until you choose them
Your own research server. If you run an MCP server that knows about domain age and reputation, FlowMail can ask it about the message. Before the first lookup, the sheet shows exactly what would be sent and offers Check on This Device Only instead. What goes is the list of domains involved — the sender’s, the reply address, and every domain the message links to — and a SHA-256 fingerprint of any attachment already on your device. The subject, the text of the message, your own address and attachment filenames are not sent, and no attachment is uploaded. FlowMail brings no server of its own to this: the lookup goes to the server you chose, or nowhere.
An on-device model to explain the findings. If you have downloaded a model in Settings, it adds a few sentences under the findings putting them in words. It gets no vote. Its lines are left out before the headline is worked out, so the verdict comes from the checks alone — which means a message written to talk a model round cannot talk itself into a clean result.
Translate a message where it is
Translate in the same toolbar turns a message into your language using Apple’s on-device translation. It keeps the message’s formatting and its quoted history, and you can switch between the original, the translation and the two side by side. A translation is kept with the message, so opening it again shows what you already translated rather than asking for it a second time. Settings sets the language it translates into.
Very long messages have a limit. When one runs past it, FlowMail translates what it can and tells you that the rest is still in the original language, rather than quietly stopping halfway.
Also in 26.2
- A transform step for workflows. Pull a piece out of a message, filter it or reformat text, and hand the result to the next step, without writing a prompt for it.
- Select several messages and archive, flag or delete them in one go.
- Filter the list to what you have replied to, or what you have not.
- Signatures sit above the quoted history in a reply, with their formatting intact, and are set per account.
- A message you answered on another device now shows as answered here too.
- Attachments are handled more reliably, including several with the same name in one message.
- Account settings say more clearly what state each account and its credentials are in.
What is free
Verify and Translate are both in the free app, on every device. The list, the Kanban board and your first workflow are free as before. FlowMail Pro adds the conversation graph, the thread tree, unlimited workflows and the Classify step, as a monthly or annual subscription or a one-time lifetime unlock — current prices are on the App Store listing, and one purchase covers iPhone, iPad and Mac.
What you need
- iOS or iPadOS 18.6 or later on iPhone and iPad, macOS 15.6 or later on a Mac.
- Nothing else for Verify. The checks on your device need no account, no server and no download. The research server and the model are extras you add if you want them.
More
- FlowMail — the product page, with the App Store links for Mac and for iPhone and iPad
- FlowMail privacy policy — where your mail lives and what leaves the device
- FlowMail FAQ — accounts, syncing and the local model
- FlowMail 26.1 — the board, the graph and the workflows this release builds on