Envelope Sender is the email address supplied in the SMTP MAIL FROM command during message transmission. It’s distinct from the From: header that end users see in their mail client. SPF authenticates the envelope sender, not the visible From — a subtle distinction that trips up nearly every DMARC deployment.
SMTP Conversation
S: 220 mx.receiver.com ESMTP
C: HELO sender.example.com
S: 250 OK
C: MAIL FROM:<[email protected]> ← envelope sender
S: 250 OK
C: RCPT TO:<[email protected]>
S: 250 OK
C: DATA
S: 354 Start mail input
C: From: "Marketing" <[email protected]> ← header From (visible)
C: Subject: Your invoice
...Envelope Sender vs From: Header
- Envelope sender — SMTP-level, used for bounce routing (
Return-Path:), authenticated by SPF - From: header — display-level, what the user sees, authenticated by DKIM alignment + DMARC
Attackers frequently pass SPF (on a legitimately-owned bounce domain) while forging the From: header pointing to a target brand. DMARC alignment closes this gap by requiring the envelope sender’s domain to align with the From’s domain.
Where This Matters
- DMARC alignment failures — SPF passes but DMARC still fails because envelope sender domain ≠ From domain
- Bounce handling — bounces are sent to the envelope sender, not the From
- Third-party ESPs — providers often set their own envelope sender (e.g.,
[email protected]), which passes SPF but fails DMARC alignment unless you configure it correctly
Check envelope-sender alignment for any domain with the email authentication checker.
Related
Check the MAIL FROM glossary entry, the Return-Path entry, and read what an SPF record is.