Envelope sender vs header From
An email has two different "sender" addresses that are often confused. The envelope sender is the address given in the SMTP MAIL FROM command (RFC 5321), used only for routing and bounce delivery between mail servers; the header From address is the human-readable "From:" field (RFC 5322) a mail client actually displays to the recipient. Nothing requires the two to match, and legitimate setups -- mailing lists, some forwarding services -- routinely set them differently. SPF checks the envelope sender's domain against the connecting server's IP, not the header From a reader sees, which is why a message can pass SPF while still displaying a different, even forged, header From address. Spammers exploit the gap by forging an uninvolved third party's address as the envelope sender, so any bounce generated for an undeliverable message lands on that victim instead of the real sender -- the mechanism behind email backscatter.
By AdminKit team, Netbase JSC · Updated