From
Displayed domain differs by one character from the enrolled organization.
For you / Content checks
Look beyondthe sender’s name.
Understand where an email came from, where its links lead, and why a request deserves a second check.
See how it worksEmail Forensics
In plain English.
Email headers are the delivery details behind a message. They can reveal a different reply address or sending path, but cannot prove the message itself is true.
A situation
worth a second look.
An invoice arrives with new bank details and a slightly different reply address.
Defeated / content checkGuided example
From: finance@example.coReply-to: payments@external-mail.test
Updated payment instructions
Please use the new account for today’s invoice.
payment-request.eml
See what a useful answer looks like.
Is the sender who they say they are?
A signal, the reason behind it, and a practical next step. This guided example uses fixed sample findings, not a live detection model.
A clearer next step.
Compare the addresses and confirm the change with your known contact.
Inspect your own contentFor technical teams: explore the method
Illustrative product views and fixed sample findings. Advanced analysis requires approved services and suitable reference data.
FROMfinance@example.co
REPLY-TOexternal-mail.net
DKIMPASS / SIGNATURE PRESENT
ROUTE3 RECEIVED HOPS
Reply path conflicts with the visible sender; verify the request out of band.
Email risk indicators do not prove who wrote a message, malicious intent, or wrongdoing.
How the review works
1Preserve
Ingest the .eml and complete headers, not a screenshot.
2Trace
Map Received hops, authentication results, return path, and links.
3Resolve
Compare sender claims with known people, domains, and prior messages.
4Act
Route consequential requests through a known verification channel.