Double domain as reply

The hostname of the protector self is spamcheck.eu.

The to address is info@domain , but after a reply it goes to  [e-mail]

The last part is somehow added by the protector in the reply and ofcourse the reply then bounces.

Any idea what is going wrong with the reply on this received mail?

The reason is because domain domain not correctly configured in DNS. A DNS query fails, and a ping replies with the same IP as domain, and with host name " domain.domain"

In fact. If the result is different depending on the DNS server you are querying, there must be something wrong, unless you have configured a private DNS server to do so.
The primary DNS server configured on filter.spamcheck.eu is 1.1.1.1, and on this DNS, domain does not exist. The default behavior in these cases is to consider the target domain part of the local domain. Therefore, it becomes "domain.domain".