Envelope-From vs Header-From — Checking a Spoofing Indicator

Two senders in every email

Every email carries two independent sender addresses. The envelope from (also called Return-Path or MAIL FROM) is transmitted during the SMTP dialogue, is normally invisible to the recipient, and serves as the return address for bounces. The header from lives in the From: header and is the address displayed in the mail client.

This separation is intentional and necessary for mailing lists and bounce handling. It is also the gap that makes spoofing possible in the first place: SPF validates the envelope from exclusively. An attacker can therefore send with their own properly configured domain in the envelope while placing your address in the visible From header. SPF reports pass — the recipient sees your name.

What AnalyzeMy.Email checks

Return-Path and From header are compared and classified into four levels:

• Exact — both addresses are identical. The cleanest state.
• Domain — different local parts but the same domain, e.g. bounce@company.com versus info@company.com. Unproblematic.
• Org — different subdomains of the same organizational domain, e.g. bounces.company.com versus company.com. Typical for email service providers and compatible with relaxed alignment.
• Mismatch — entirely different domains. SPF alignment under DMARC becomes unreachable.

Why the mismatch matters

A mismatch is not automatically malicious. Newsletter tools deliberately use their own bounce domains and that is common practice. What matters is the consequence for DMARC: with a genuine mismatch, SPF alignment can no longer be achieved. Your DMARC outcome then rests entirely on DKIM. If the DKIM signature breaks — through a footer added by an intermediate system, for instance — the message fails DMARC even though SPF reported pass.

On a message you did not expect, however, a mismatch is a strong warning sign. Combined with missing DMARC alignment and a diverging Reply-To, it is the classic pattern of a phishing message.

What you can do

• If you use an email service provider, configure your own subdomain as the bounce domain (custom return path). That turns a mismatch into an org match and restores SPF alignment.
• Make sure DKIM signs with your own domain (d=), not the provider's.
• With aspf=s (strict), verify that domains really match exactly — otherwise you block your own mail.