The two From addresses — Email Authentication Fundamentals

The two From addresses

After this lesson you can

Tell the envelope sender from the header From in a raw message, and say which one the recipient sees.

Assumes you have read Inside an SMTP conversation.

Email has two sender addresses. Almost every confusing thing about SPF, DKIM and DMARC traces back to that fact, and to the fact that the one a user sees is not the one most of the machinery checks.

The two addresses

	Envelope sender	Header From
Where it is	The SMTP command `MAIL FROM`	The `From:` header, inside the message
Defined by	RFC 5321 §3.3	RFC 5322 §3.6.2
Shown to the recipient	Never	Always
What it is for	Where bounces go	Who the message says it is from
Authenticated by	SPF	Nothing, by itself

Two different standards, written for two different layers, and the addresses in them are allowed to differ. They very often do, entirely legitimately.

Why there are two

The envelope exists so a bounce can be returned to something other than the author. A mailing list wants delivery failures to go to the list software, not to whoever posted. A marketing platform wants them on its own infrastructure so it can process them. In both cases the message should still say it is from the author or the brand.

So this is a perfectly ordinary, non-malicious configuration:

MAIL FROM:<bounce-8823-4471@mail.somesaas.com>
...
From: "Acme Billing" <billing@acme.com>

Envelope on the sender platform, visible From on the brand. Entirely normal, and indistinguishable at this level from an attack.

This is the whole problem, in two lines

SPF checks the envelope. The user reads the header. A message can pass SPF for mail.somesaas.com while displaying From: billing@acme.com, and SPF is satisfied, because SPF was never asked about the visible address. Nothing is broken — SPF is doing exactly what it was specified to do.

Finding them in a message you have

In a delivered message, the envelope sender is preserved in the Return-Path header, written by the receiving server at delivery time. So in any client that will show you full headers, look for:

Return-Path: — the envelope sender. The one SPF checked.
From: — the header From. The one the user saw.

If those two addresses are on unrelated domains, the message is not necessarily suspicious — but it is a message where SPF alone tells you nothing useful about the visible sender, and you should be looking for a DKIM signature instead.

The third identity: the display name

The From: header has two parts, and only one of them is an address:

From: "Acme Billing" <billing@acme.com>
       ^^^^^^^^^^^^^^  ^^^^^^^^^^^^^^^^^
       display name    address

The display name is free text with no constraints at all. It can contain a name, a company, or another email address entirely. Many mail clients — particularly on mobile, where there is no room — show only the display name.

Nothing in SPF, DKIM or DMARC has anything to say about the display name, because the address really does belong to the sender. Keep that in mind for the rest of the course: we are about to spend several hours securing one of these three identities, and it is worth knowing from the start which two are left over.

Last reviewed 2026-09-12