The Reply-To header

Reply-To tells your mail app where to send your reply. If a message has one, pressing Reply addresses your answer to the Reply-To address instead of the From address, and most apps don't make the switch obvious. Plenty of legitimate mail uses it: mailing lists, help desks, and companies that send from a "no-reply" address. It's also the core of a common fraud pattern, where a message appears to come from someone you trust but replies go to a stranger. Before you reply to anything involving money, credentials or sensitive data, check where your reply is actually going.

From: Jordan Lee <jordan.lee@example.com>
Reply-To: Jordan Lee <jordan.lee.office@example.net>

What the standard says

RFC 5322 §3.6.2 groups Reply-To with From and Sender as the originator fields:

• Reply-To is optional, and a message may have at most one (RFC 5322 §3.6). That one field can list several addresses.
• When present, it gives the address or addresses the author suggests replies go to. Without it, replies go to From by default.
• Nothing about it is verified. Neither SMTP nor SPF, DKIM or DMARC checks that the Reply-To address belongs to the sender. DKIM can sign it, which proves only that it wasn't changed after signing.

RFC 5322 §3.6.3 explains how mail apps build a reply's To line from these fields. In practice, "Reply all" often combines Reply-To with the original recipients, and each app handles the details a little differently.

Legitimate uses

Mailing lists. Some lists set Reply-To to the list address so replies go to everyone. Others set it to the original poster. Either is normal for a list.

Help desks and ticketing systems. A message From: Support <support@example.com> may carry Reply-To: support+ticket-48213@example.com or an address at the help-desk vendor's domain, so your reply is threaded into the right ticket.

No-reply senders. Notifications sent from no-reply@example.com often set Reply-To to a real support mailbox, which is the considerate thing to do.

Marketing and newsletters. Campaigns sent through a mail service may set Reply-To to the company's own inbox so customer replies don't land at the service.

People sending on someone's behalf. An assistant or a shared mailbox might set Reply-To to the person who should get answers.

In all of these, the Reply-To address clearly belongs to the same organization, to a service working for it, or to a list you subscribed to.

The fraud pattern

Business email compromise (BEC) and invoice fraud often depend on Reply-To. The pattern:

1. The message looks like it's from a colleague, executive, supplier or lawyer. The From line may use a real-looking display name, a look-alike domain, or even the genuine address if the sender's domain has weak authentication.
2. The text asks for something time-sensitive: change bank details, pay an invoice, buy gift cards, send a payroll file.
3. Reply-To points to an address the attacker controls, often a free webmail account or a domain that's one character off.
4. You hit Reply. Your mail app shows the familiar display name, so you don't notice the address changed. The rest of the conversation happens with the attacker.

From: "Finance Director" <finance.director@example.com>
Reply-To: "Finance Director" <finance.director.example@mail.example.net>
Subject: Updated remittance details - urgent

The display name is the same in both fields, so many mail apps show nothing unusual in the reply window. The real address differs.

A variant skips Reply-To entirely and relies only on a misleading display name; see display-name spoofing. Another uses a genuine compromised mailbox, in which case From, Reply-To and authentication all look correct. That's why the advice below includes verifying through a different channel.

Red flags in Reply-To

• A free webmail Reply-To on a message claiming to come from a company, bank or government body.
• A Reply-To domain that's a near miss of the From domain: extra letter, swapped characters, different top-level domain, digits for letters.
• A Reply-To that doesn't appear anywhere else in the message: not in the signature, not at the sender's known domain.
• A Reply-To on a message from someone who has never used one before in your existing conversations with them.
• The same display name on From and Reply-To with different addresses, apparently designed so you won't spot the switch.

None of these alone proves fraud. Help desks and mail services create odd-looking Reply-To addresses all the time. Combined with an urgent payment request, they're serious.

How to check before replying

1. Look at the address, not the name. Open the raw headers (see how to view headers) or hover over or tap the sender name to reveal the address. In the reply window, click into the To field to see the full address your reply will go to.
2. Compare domains. Is the Reply-To domain the same organization as the From domain, or a service you'd expect it to use?
3. Check authentication. In Authentication-Results, did DMARC pass for the From domain? A pass means the From domain is genuine. It says nothing about Reply-To.
4. For anything financial, don't reply at all. Start a new message to an address you already have, or phone a number you already have. Never use contact details from the suspicious message itself.

Tip: The analyser flags messages where Reply-To differs from From and shows both addresses side by side, so a switched address is easy to see.

Reply-To versus Return-Path

These two are often confused. Return-Path is where automatic bounces go and is used by SPF; people never see it in normal use. Reply-To is where human replies go and isn't checked by any authentication method. A message can have a perfectly normal Return-Path at a mail service and a malicious Reply-To, or the other way round. They answer different questions.