Skip to content
Inbox Theory
General

Envelope sender (Return-Path / MAIL FROM)

The envelope sender is the address the SMTP transaction names for bounces, distinct from the From header users see. Why the two differ and why it matters.

The envelope sender is the address a sending server states in the MAIL FROM command of the SMTP transaction: the address bounces return to, the address SPF evaluates, and an address the recipient normally never sees. It is recorded in the delivered message as the Return-Path header. Every email therefore carries two sender identities, the envelope sender for the mail system and the From: header for the human, and most authentication confusion in email traces back to conflating them.

Why the two addresses legitimately differ

Bounce processing wants a machine-readable destination, so bulk senders use dedicated bounce addresses, often unique per recipient (a scheme called VERP), on a dedicated subdomain. ESPs default to envelope senders on their own platform domains so their systems catch the bounces. Mailing lists set the envelope sender to the list so delivery failures go to the operator rather than the original author. None of this is deceptive; it is division of labour between the transaction layer and the display layer.

Where it matters operationally

SPF evaluates the envelope sender domain, not the From: header, which is why an SPF pass can help another company's domain entirely. DMARC closes that gap by requiring alignment between the envelope domain and the From: domain, and the standard fix on sending platforms is a custom bounce domain: a subdomain of yours delegated to the provider. In addition, the envelope sender's domain must accept mail, since bounce handling depends on it, and some receivers probe it (callback verification) and penalize dead bounce domains.

One special case completes the picture: bounces themselves are sent with an empty envelope sender (MAIL FROM:<>), precisely so that bounces can never bounce back and loop. Receivers evaluate SPF for such messages against the HELO hostname instead, which is why sending hosts should announce themselves with a real name under your domain.

Frequently asked questions

How do I see the envelope sender of a message I received?
Open the full headers and read the Return-Path header, which the receiving server writes from the SMTP envelope at final delivery. Authentication-Results also names it in the smtp.mailfrom field.
Should the envelope sender match the From address exactly?
Not necessarily; sharing the organizational domain is what DMARC's default relaxed alignment requires. bounce@mail.example.com under From: news@example.com is the standard, fully aligned pattern.
Why do spammers care about the envelope sender?
Historically they passed SPF using envelope domains they owned while displaying someone else's From: header, which is exactly the trick DMARC alignment exists to stop.

Key takeaways

  • The envelope sender lives in the SMTP transaction, receives the bounces, and is what SPF evaluates
  • It legitimately differs from the visible From: header; Return-Path is its trace in delivered mail
  • DMARC alignment connects the two, and custom bounce domains are how sending platforms achieve it
  • Bounces travel with an empty envelope sender, shifting SPF evaluation to the HELO hostname
Envelope sender vs From header: Return-Path explained | Inbox Theory