Envelope From and Header From: why every email has two sender addresses

Every email carries two sender addresses. They can match, or they can be completely different. This is not a bug or a forgery — it is how SMTP has worked since it was designed.

Envelope From (MAIL FROM)

Envelope From is the technical sender address passed in the SMTP MAIL FROM command when servers exchange the message:

Recipients never see this address in normal view. It gets recorded in the Return-Path header after delivery. Its job is to receive bounce notifications: when a message cannot be delivered, the receiving server sends a Delivery Status Notification (DSN) to the Envelope From address.

The same address goes by several names: MAIL FROM, bounce address, envelope sender, and Return-Path (once it is written into the delivered message headers).

Header From

Header From is the address a recipient sees in their mail client's "From" field. It lives in the From header inside the message itself:

This address represents the brand. The recipient reads it and decides whether to open the message.

The paper mail analogy

Think of a physical letter. The envelope shows a return address — that is where undeliverable mail goes back. The letter inside names the actual sender. Those two addresses can differ: a secretary mails a letter on behalf of an executive, using the company's return address on the envelope but the executive's name on the letterhead.

Why they differ in practice

Several common sending scenarios produce mismatched addresses:

• Sending through an ESP. Your Header From shows newsletter@yourcompany.com, but the ESP sets its own Envelope From (e.g. bounce-xyz@esp-bounces.com) so its bounce-processing system receives the DSNs.
• Forwarding. The forwarding server replaces the Envelope From with its own address, so any bounce from the final recipient goes to the forwarder rather than the original sender.
• VERP. To identify exactly which subscriber bounced, an ESP generates a unique Envelope From per recipient — for example bounce+user123@bounces.esp.com.
• Transactional mail via relay. An application sends through a relay service. The Header From carries the brand address; the Envelope From belongs to the relay.

Effect on email authentication

The distinction between the two addresses is what makes SPF, DKIM, and DMARC work — and what causes failures when they are not aligned:

• SPF checks the domain in the Envelope From. If the Envelope From is bounce@bounces.esp.com, SPF validates bounces.esp.com, not your domain.
• DKIM validates a signature against the domain in the d= tag of the DKIM-Signature header. That domain can be yours or the ESP's.
• DMARC works off the Header From domain. To pass DMARC, at least one of SPF (Envelope From domain) or DKIM (d= domain) must align with the Header From domain. If both differ, DMARC fails.

How to set up alignment

For SPF alignment, configure a custom Envelope From on a subdomain of your own domain. Most ESPs support this:

Both domains share the organizational domain yourcompany.com, so relaxed SPF alignment passes. To make this work, add a CNAME record for mail.yourcompany.com pointing to the ESP's DNS, then include the ESP's SPF mechanism in your DNS record.

DKIM alignment works the same way: configure the ESP to sign outbound messages with your domain (d=yourcompany.com). This typically requires adding a CNAME record in your DNS to delegate the signing key to the ESP.

Spoofing and security

The ability to set an arbitrary Header From is the root cause of email spoofing. A spammer can write From: ceo@bank.com, and that is what the recipient sees. SPF, DKIM, and DMARC exist to let receiving servers verify whether the sender was actually authorized to use that domain.

Without authentication records in DNS, any server can send mail with your domain in the Header From. With p=reject in your DMARC record, receiving servers will refuse messages that fail both SPF and DKIM alignment.