What this analysis does
Mailybox compares a known earlier message with a later message from the conversation, then scores material changes across the visible From identity, display name, Reply-To, Return-Path, DKIM signing domain, Message-ID domain and receiver-stamped authentication. Payment and urgency language is treated only as context, never as proof of fraud.
How to use the result
Use real evidence
Paste the exact domain, header, message or configuration. The result is only as useful as the evidence supplied.
Review the findings
Mailybox separates observations from inferred causes so you can see what is known and what still needs verification.
Retest after changes
Email authentication and routing are stateful. Re-run the analysis after publishing a fix.
Interpretation matters
Email systems combine DNS, message-level evidence, provider policy and intermediate infrastructure. A single passing check is not proof that every message will deliver, and a single warning is not proof that a domain is misconfigured. Mailybox is designed to expose the evidence and the relationship between signals so the next action is clear.