Glossary
EMAIL AUTH

MAIL FROM

The SMTP command declaring the envelope sender for a message. Distinct from the From: header. The address SPF actually checks.

MAIL FROM is the SMTP command that declares the envelope sender of a message during the SMTP conversation. The address in MAIL FROM — not the address in the From: header — is what SPF authenticates and what bounces are sent to.

SMTP Format

C: MAIL FROM:<sender@example.com>
S: 250 2.1.0 sender@example.com... Sender ok

What Ends Up Where

  • The MAIL FROM value becomes the Return-Path: header when the message is delivered
  • The From: header inside the message is set separately by the sending application
  • Users see From:; SPF checks MAIL FROM; DMARC alignment checks both agree

Why It’s the SPF Check Point

SPF is a sender authorization check, not a sender identity check. It asks: “is this IP allowed to send mail for this domain?” — where the domain is taken from MAIL FROM. That’s why a phishing message can pass SPF while forging the From: header — SPF never looks at From:.

DMARC alignment closes this by requiring the MAIL FROM domain to match (or align with) the From: domain.

Null Sender

The special value <> — no address — is used for bounce messages, to prevent bounce loops.

Common Miss

  • Confusing SPF failure with From: spoofing — SPF may pass while From: is forged
  • Sending from a domain whose SPF doesn’t include your MAIL FROM server → SPF SoftFail or Fail
  • Third-party senders (SendGrid, Mailchimp, Postmark) that set their own MAIL FROM — must configure alignment carefully

Verify your MAIL FROM alignment with the email authentication checker.

Check the envelope sender glossary entry, the Return-Path entry, and read what an SPF record is.

← All terms Learning hub →