I've found that if you hover over a link in the email it will show the web site name... it's never legit.
