What Header From means
The From field of RFC 5322 is the only sender identity a mail client displays. It is not the address SMTP used to deliver the message — that is the envelope sender — and it is not necessarily the domain that signed it. Specifications call it RFC5322.From where the distinction has to be unambiguous.
DMARC is defined entirely in terms of this field. The policy a receiver consults is the one published by the header From domain, and the message passes only when an SPF or DKIM pass is aligned with that domain. Which makes the From field the thing worth protecting: a forged From domain is exactly what DMARC stops, while display-name spoofing, which puts a familiar name in front of an unrelated address, is beyond its reach entirely.
RFC 5322 permits more than one address in From, and DMARC does not define what a receiver should do with the second one; in practice receivers either reject such messages or evaluate only the first. Sending a single address, in a domain you publish records for, avoids a class of handling nobody has agreed on.
See it on your own domain. Every term in this glossary is something one of the eleven checks reads and reports.
Browse the lookupsKeep reading
Related checks, definitions and guides.
- Envelope sender The other sender address, the one SMTP uses.
- DMARC The policy looked up under this domain.
- DMARC alignment The match every other identifier is measured against.
- How email authentication fits together Which identity each protocol actually checks.
- Reading email headers Finding From, Return-Path and the trace fields in a raw message.