A message can use a familiar From address while directing replies elsewhere. That difference can be legitimate, such as a ticketing service, or it can redirect a sensitive conversation. Investigate the actual fields and the receiving trust boundary before calling the mismatch an attack or treating authentication as approval of the reply destination.
Understand the field's role
RFC 5322 describes Reply-To as the mailbox or mailboxes to which the author suggests replies be sent. In its absence, replies normally go to the From mailbox. This is a message-format instruction, distinct from SMTP envelope delivery and distinct from a human approval decision. Clients and workflow tools may apply their own reply behavior, so inspect the actual recipient before sending a sensitive response. RFC 5322 section 3.6.2.
DMARC uses the author domain, not the Reply-To field, for its identity relationship. A pass therefore does not establish that a different Reply-To domain belongs to the same organization. A valid DKIM signature can cover Reply-To when that field is included in the signature's signed-header list, but integrity of a value is not permission to use it for confidential correspondence. DMARC and DKIM.
Annotate the original rather than a screenshot
Retain raw message bytes. Create a separate annotation showing From, Reply-To, Return-Path, DKIM d= and h= values, and the receiving system that produced Authentication-Results. Mark From and Reply-To as sender-provided fields, the DKIM signature as a claim requiring verification, and authentication results as trusted only when their provenance is established. RFC 8601.
Do not assume that a copied Authentication-Results line is genuine. Likewise, a Return-Path field in an arbitrary saved text file does not independently prove the SMTP envelope. Correlate with authorized receiving logs where needed.
Compare three written header scenarios
Assume visible From billing@supplier.example.test in each case. Envelope identity, DKIM d= and h= values, actual signatures and trusted receiver results are not supplied. A copied pass assertion cannot fill those gaps.
- Unexpected route: Reply-To case@support.example.test; no workflow approval supplied. Flag the different exact domain for review, hold sensitive replies and ask the service owner through a known channel.
- Same-domain route: Reply-To help@supplier.example.test. An exact-domain mismatch rule would not flag it, but this is not proof that the mailbox or requested information is authorized.
- Scoped exception: Reply-To case@tickets.example.test; assume a fictional inventory permits this service only for routine support tickets. Treat it as expected for that purpose, not permission for payment changes or confidential documents.
These examples are written values and decisions, not an included .eml file, parser run or real authentication result. No DKIM signature is fabricated. The proposed service owner verifies both recipient and permitted information before a real reply; the mail investigator separately obtains original bytes and trusted authentication evidence.
Verify the reply destination against the workflow
Ask the service owner whether the external destination is expected for this message type and whether it is appropriate for the proposed information. A support mailbox may legitimately differ from a billing sender, yet still be unsuitable for payment instructions or sensitive attachments. Approval should match the purpose, not merely the domain's existence.
For unexpected requests, contact the supposed sender through a known independent channel. Do not test a questionable destination by emailing confidential material. If a client automatically populated Reply-To, cancel the draft until the destination is verified.
Close the field-level question
Record whether the mismatch was expected, unauthorized or unresolved, and what evidence supports that finding. Keep authentication results as a separate observation. This preserves a useful distinction: a message may be intact and domain-authenticated while its suggested reply route is inappropriate for the business action.