Investigate a matter: what the registry and the links say

Reads, at that instant, the facts public infrastructure holds about the sender's domain (its registration date and registrar, its SPF and DMARC posture, whether it receives mail), where every link of the source message really goes (the redirects followed one hop at a time, the final host and its domain's facts), and what each attachment really is (its first bytes against the name and the declared type). Answers the dossier with the signals the facts add (a domain registered days ago, a link that lands elsewhere, a sender's domain that protects nothing, a program named as a document). No vendor, no account, nothing stored; a lookup that fails is a fact of its own.