The sender's domain contains punycode, a technique used by attackers to impersonate legitimate domains.
type.inbound and strings.ilike(sender.email.domain.domain, "*xn--*")
Test against your own EMLs or sample data.
Post about this on your socials.
Managed or self-managed. No MX changes.