The Second Address Problem: Auditing Reply-To Before Your Users Hit Send

Most of us read email headers like we read the small print on a car park ticket: quickly, and only after something has gone wrong. The From line gets all the attention. It is the name above the door. Reply-To is the address on the back of the beer mat — the one that actually gets used when someone taps reply. And that is exactly why it has become a favourite hiding place.

In 2026, a convincing invoice scam rarely needs to spoof your finance director's domain. It can send from a plausible address — maybe a compromised supplier account, maybe a freshly registered .uk lookalike — and set Reply-To to a free mailbox in the hope that the person answering the query sends bank details, attachments or a helpful 'can you confirm this?' straight to the wrong place. The From line passes the eye test. The reply path does not.

Why the gateway lets it through

SPF, DKIM and DMARC are built to authenticate the domain in the From header. They do not authenticate Reply-To. A message can pass DMARC cleanly and still tell your users to reply to an unrelated Gmail address. Gateway filters tend to score the sender, the domain reputation, the attachment and the URL. Reply-To is often treated as a routing detail rather than a trust signal.

That is not pure laziness. Legitimate mailing lists, ticketing systems and shared inboxes use Reply-To constantly. A newsletter may send from a bulk subdomain and ask replies to go to a support address. An ITSM tool may send from a no-reply address and route replies into a queue. Blanket-blocking every mismatch would create a new problem: false positives in the sort of mail people actually need. So the filter shrugs, and the mismatch slides through.

The anatomy of a mismatch

The pattern is simple enough to spot once you know what you are looking at. A message claims to be from a UK supplier, a payroll team or a known mailing list. The From address looks right — or right enough. The Reply-To points somewhere else: a free-mail domain, a lookalike domain with one character changed, or an address that has nothing to do with the organisation named in the display name.

There are variations. A display name might say Accounts Payable while the underlying address says something random. A message might carry more than one Reply-To. A mailing list might use a legitimate but unfamiliar ESP domain. None of these are automatically malicious. The point is not to ban the pattern. The point is to make it visible.

Where UK teams should look first

Invoice and remittance mail is the obvious one. A supplier asks you to confirm a bank detail change, and the reply path sends your confirmation to a mailbox the real supplier has never heard of. HR mail is close behind: payroll queries, P60 requests, pension paperwork, right-to-work checks. These threads often start with a plausible-looking message and depend on a quick reply from a busy person.

Mailing lists deserve their own look. A newsletter with a Reply-To at a lookalike .co.uk domain is not necessarily a scam, but it is worth checking against the list owner's known sending domains. Shared inboxes — info@, accounts@, sales@ — are where these messages pile up and where a tired reply is most likely.

Header-reading steps for admins

You do not need a forensic toolkit to check a reply path. Start with the raw message.

1. Open the internet headers. In Outlook, open the message and look under File > Properties. In Gmail, use the three-dot menu and choose Show original. In Microsoft 365, message trace or Explorer can show the full header block.

2. Pull out the relevant lines. Look for From, Reply-To, Return-Path and the Authentication-Results header. A quick command-line grep for '^reply-to:' and '^from:' is enough to compare the two.

3. Compare domains, not just display names. A display name is cosmetic. The domain after the @ is the part that decides where the reply goes.

4. Check for free-mail Reply-To addresses on corporate From domains. This is not always malicious, but it is a useful amber flag, especially on invoice or HR threads.

5. Look for lookalike domains. One wrong character, a different TLD, or a hyphen in the wrong place is easy to miss at a glance. Check the Reply-To domain against your known partner list.

6. Note multiple Reply-To addresses or encoded display names. These are not proof of anything, but they deserve a second look.

A simple triage policy

You do not need a 40-page standard to make this useful. A three-tier policy will do.

Green: no Reply-To header, or a Reply-To that matches the From domain, or a known mailing-list address with consistent history. Let it through.

Amber: a free-mail Reply-To on a corporate From domain, a Reply-To domain registered recently, or a lookalike within a character or two of a known partner domain. Tag it for review. Hold external invoice and HR mail in this tier if your gateway supports it.

Red: a Reply-To domain that lookalikes your own domain, multiple Reply-To addresses on an unsolicited message, or a display name that promises one organisation while the address points somewhere unrelated. Quarantine and tell the user why.

Review amber messages weekly, not daily. Sample a handful, check whether a reply would leave the organisation, and add known partner reply paths to an allowlist only after someone has verified them by a separate channel. The reply path is part of your trust boundary. Audit it before the first near miss, not after.