Header forensics 200 pts · Medium

Finance forwarded this to the SOC. The From header is the costume. Which domain actually sent it (the envelope sender)?

Return-Path: <billing@secure-pay-notice.example>
Received: from mail-relay-07.secure-pay-notice.example (203.0.113.77) by mx1.corp.example with ESMTPS
Authentication-Results: mx1.corp.example; spf=fail smtp.mailfrom=secure-pay-notice.example; dkim=none; dmarc=fail header.from=paymentsteam.example
From: "Payments Team" <accounts@paymentsteam.example>
Reply-To: <collections@secure-pay-notice.example>
To: <finance@corp.example>
Subject: Invoice INV-20931 overdue: action required

Flag format: dbse{domain_with_the_dot_as_an_underscore}.