Question 1

Why do replies go to a different address?

Accepted Answer

Scammers send from a convincing address but set Reply-To to a mailbox they control, so your answer reaches them. Legitimate senders rarely do this for personal mail.

Question 2

What do SPF, DKIM and DMARC mean?

Accepted Answer

They are checks your mail provider performs to verify that the sending server is allowed to use the domain (SPF), that the message was not altered (DKIM), and what to do when either fails (DMARC).

Question 3

Can the tool prove who sent an email?

Accepted Answer

It can show whether the claimed sender passed authentication and where the message actually came from. Forged headers above the first trusted hop are possible, which is why the earliest Received lines matter.

Is this email really from who it says?