Envelope From vs Header From: Return-Path and MAIL FROM Explained

Every email has two From addresses. The envelope From, set with the SMTP MAIL FROM command and recorded as the Return-Path header on delivery, is where bounce messages are sent. The header From is the line inside the message that recipients see in their inbox. They are often identical, but they do not have to be, and several authentication checks depend on which one is being examined.

Quick summary

• Bounce handling: a sending system uses a dedicated envelope address per message so bounces can be matched automatically, while the visible From stays friendly.
• Mailing lists: a list re-sends your post with its own envelope From so bounces go to the list, not to you.
• Forwarding: a forwarder rewrites the envelope From to its own domain (SRS) so the forwarded copy passes SPF at the final destination.
• Marketing tools: the envelope From is on the vendor bounce domain unless you configure a custom bounce domain.
• SPF checks the envelope From domain (and the HELO name). A spoofer who uses their own envelope domain passes SPF.

The postal analogy that actually holds

Think of a letter inside an envelope. The address printed on the envelope tells the post office where to return it if delivery fails. The letterhead inside tells the reader who wrote it. Mail servers only look at the envelope while routing; the reader only sees the letterhead. SMTP works the same way: MAIL FROM and RCPT TO are the envelope, and the From, To and Subject headers are the letter.

Example: the two addresses in one message

SMTP envelope (never shown to the reader):
  MAIL FROM:<bounces@yourdomain.com>
  RCPT TO:<customer@example.com>

Message headers (what the reader sees):
  Return-Path: <bounces@yourdomain.com>   <- added by the receiving server from MAIL FROM
  From: Acme Support <support@yourdomain.com>
  To: customer@example.com

Why they legitimately differ

• Bounce handling: a sending system uses a dedicated envelope address per message so bounces can be matched automatically, while the visible From stays friendly.
• Mailing lists: a list re-sends your post with its own envelope From so bounces go to the list, not to you.
• Forwarding: a forwarder rewrites the envelope From to its own domain (SRS) so the forwarded copy passes SPF at the final destination.
• Marketing tools: the envelope From is on the vendor bounce domain unless you configure a custom bounce domain.

Which check looks at which address

1. SPF checks the envelope From domain (and the HELO name). A spoofer who uses their own envelope domain passes SPF.
2. DKIM checks the d= domain in the signature, which is independent of both From values.
3. DMARC checks the header From domain and demands that SPF or DKIM align with it. This is the check that finally ties the visible address to authentication.
4. Spam filters compare the two and may score a mismatch, especially when the envelope domain is unrelated and DKIM is missing.

How to see both on a real message

In Gmail, open the message and choose Show original. The Return-Path header near the top shows the envelope From; the From header shows the displayed one. In Outlook, open the message, then File, Properties, and read the Internet headers box. The authentication (proof that email really comes from your company)-Results header shows SMTP (the standard way computers hand off outgoing email).mailfrom= for the envelope and header.from= for the visible domain.

Common mistakes

• Setting a website form to send From the visitor address while the envelope is your domain. DMARC fails for the visitor domain and the mail is rejected. Put your address in From and the visitor in Reply-To.
• Assuming SPF pass means the visible From is genuine. It only vouches for the envelope.
• Using a no-reply envelope address that rejects mail, so bounces bounce and you never learn about bad addresses.
• Sending from a tool with a vendor envelope domain and wondering why DMARC only passes through DKIM.

What OquMail does

Mail sent from an OquMail mailbox or through the send API uses an envelope From on your own verified domain and signs with DKIM for the same domain, so SPF and DKIM both align with the header From and DMARC passes cleanly. Bounces return to OquMail, which records the remote response in the per-message delivery log where you can read the exact reason.

Common questions

Can the header From be on a different domain from the envelope?

Yes, technically. Whether it is accepted depends on DMARC alignment: DKIM for the header From domain will still pass it.

Is Return-Path the same as Reply-To?

No. Return-Path is where automated bounces go and is set by the server. Reply-To is where a human reply goes and is set by the author.

What is the Sender header?

An optional header naming who transmitted the message when it differs from the author, common with delegated mailboxes. It does not affect SPF or DMARC.