DMARCGuardian Practical help for DMARC, SPF, DKIM, and BIMI.

Blog · Dmarc

What is the Difference Between Mail-From and From Header in Email?

By DMARCGuardian Editorial Team ·

Every email has two different sender identities that most people never think about. One tells the mail server who delivered the message. The other tells the recipient who sent it. Confusing these two is one of the most common reasons SPF and DKIM pass but DMARC still fails.

This article explains the difference between the RFC 5321 Mail-From and the RFC 5322 From header, how SPF and DKIM use each one, and why DMARC alignment specifically checks the From header domain.

What is the RFC 5321 Mail-From (envelope sender)?

The Mail-From is the envelope sender defined in RFC 5321. It tells receiving mail servers who paid for the delivery. This is the address that bounces go to when something goes wrong. It is also the address that SPF validates.

When a receiving mail server checks SPF, it looks at the domain in the RFC 5321 Mail-From field, not the From header that users see in their email clients.

The Mail-From is set during the SMTP conversation, before the message body is even transmitted. It lives in the email envelope, not the message headers.

Example:


MAIL FROM:<bounces@example.com>

What is the RFC 5322 From header (display sender)?

The From header is defined in RFC 5322. This is what the recipient sees as the sender in their email client. It is the identity that matters to humans, not to mail servers.

When you open an email and see "From: Jane Smith <jane@example.com>", that is the RFC 5322 From header. It is the display identity.

Example header:


From: Jane Smith <jane@example.com>

How SPF and DKIM use these fields differently

SPF validates the envelope sender (Mail-From, RFC 5321). It checks whether the IP address sending the email is authorized to send for the domain in the Mail-From field.

DKIM validates the message content using a cryptographic signature attached to the email. The DKIM signature is tied to the domain that signed the message, which may or may not match the From header domain.

Neither SPF nor DKIM automatically validates the From header domain. That is what DMARC does.

Why DMARC alignment checks the From header, not Mail-From

DMARC was designed to prevent email spoofing. Spoofing happens when someone sends email with a forged From header domain. The From header is what recipients see, so that is what attackers want to fake.

DMARC alignment means the domain used in the From header must match the domain that passed SPF or DKIM. If the Mail-From domain is bounces@example.com and the From header domain is example.com, those are two different domains. Without alignment, a message can pass SPF but still fail DMARC.

The three DMARC alignment outcomes:

  • Aligned pass: From domain matches the domain that passed SPF or DKIM
  • SPF aligned fail: Mail-From domain and From domain do not match, and SPF did not align with From
  • DKIM aligned fail: The signing domain and From domain do not match

This is why DMARC failures often surprise people who have valid SPF and DKIM records but never considered the From header domain.

Real-world scenario: SPF passes but DMARC fails

Here is a concrete example of how this confusion plays out.

A company uses a marketing automation platform to send newsletters. The platform sends email with:

  • Mail-From: bounces.marketingplatform.com (required by the platform)
  • From header: newsletter@company.com (the brand the company wants recipients to see)

The company's SPF record authorizes marketingplatform.com to send for bounces.marketingplatform.com. When the marketing platform sends the email, SPF passes for bounces.marketingplatform.com.

But DMARC alignment checks the From header domain: company.com. Since SPF was validated against bounces.marketingplatform.com, not company.com, alignment fails. DMARC returns a result of fail, even though the email came from an authorized server.

This is not a bug. It is the intended behavior. DMARC is protecting against exactly this scenario: a domain that appears in the From header but comes from an unauthorized mail server.

How to check which headers your email is using

To see the difference between Mail-From and From in your own email, examine the raw message headers.

In Gmail, click the three dots next to a message and select "Show original". Look for these fields:


Return-Path: <bounces@example.com>
From: Jane Smith <jane@example.com>

Return-Path is the same as the Mail-From (envelope sender). From is what users see. If the domains differ, that is a Mail-From and From mismatch.

In the SMTP conversation, these two fields serve different purposes:


HELO mail.example.com
MAIL FROM:<bounces@example.com>
RCPT TO:<recipient@gmail.com>
DATA
From: Jane Smith <jane@example.com>
Subject: Newsletter

The MAIL FROM command sets the envelope sender. The From header inside the DATA block sets the display sender.

Common causes of Mail-From and From mismatch

Several legitimate email scenarios produce a mismatch between Mail-From and From:

Marketing automation platforms often use their own domain in the envelope sender for bounce handling while keeping your brand domain in the From header. This is normal for these tools.

Mailing lists may change the From header to show the original sender while keeping the mailing list address as the Mail-From for bounces.

Bulk email providers frequently send from their own infrastructure with their own envelope domain, even when the From header shows your domain.

Forwarded email can break alignment entirely. When a mail server forwards a message, it becomes the new RFC 5321 sender. If the original From header does not align with the forwarder's domain, DMARC fails on the forwarded copy.

None of these mean your email is broken. They mean your DMARC policy is catching a real mismatch. Whether that mismatch is acceptable depends on whether the sending source is authorized to send on behalf of your From header domain.

How DMARC monitoring helps detect alignment issues

If you do not look at your DMARC aggregate reports, you cannot see alignment failures. A DMARC aggregate report shows how many messages passed or failed alignment, broken down by the sending domain.

When you see failures with explanations like "SPF aligned fail" or "DKIM aligned fail", it means your email is being sent with a Mail-From or DKIM signature domain that does not match your From header domain. That is exactly the scenario described above.

DMARCFlow aggregate reports show alignment failures broken down by sending source, with separate counts for SPF and DKIM alignment failures. If your DMARC policy is p=quarantine or p=reject and you are not monitoring reports, you are flying blind on whether your email is actually reaching inboxes. For teams managing multiple sending sources, DMARCFlow makes it straightforward to identify which vendor or platform needs either DKIM signing on the From header domain or explicit authorization via SPF.

Checking your reports regularly is the only way to know whether your email authentication setup is actually working the way you expect.

FAQ

Can SPF pass but DMARC still fail?
Yes. SPF validates the Mail-From (envelope sender) domain. DMARC alignment validates the From header (display sender) domain. If those two domains differ and the From domain is not authorized by SPF or DKIM, DMARC fails.

Does DKIM verify the From header?
No. DKIM verifies that the message content has not been modified and that the message was signed by the domain in the DKIM signature header. That signing domain may or may not match the From header domain. DMARC alignment checks whether the DKIM signing domain matches the From domain.

What is the fastest way to check my own email headers?
Send a test email to yourself and view the raw message source. In Gmail, use "Show original". Look for Return-Path (which equals the Mail-From) and From. If they show different domains, that is a mismatch.

Should the Mail-From and From always match?
Not always. Third-party senders like marketing platforms, mailing lists, and bulk email providers commonly use different domains for the envelope and display sender. The key question is whether those senders are authorized to send for your From header domain.

How does DMARC alignment work with forwarding?
When a message is forwarded, the forwarder's mail server becomes the new RFC 5321 sender. The original From header domain no longer aligns with the new Mail-From domain. This is why forwarded messages often fail DMARC even when the original message was properly authenticated.