smtp envelope "from" vs. message header From:

Question

What is the difference in semantics between the SMTP envelope "from" (e.g. MAIL FROM:<[email protected]> and the From: header field in the message itself?

Is there a legitimate reason (other than something shady like spam or exploits) for these to differ?

Answer 1

The smtp.mailfrom or envelope from is the address used in the Return-Path header. As the name of the header somewhat suggests, this address is used for automatic response, e.g. bounces.

Many third party systems for marketing email or transactional email use a different Return-Path address, for the bounce-handling feature, where bounced addresses are taken out of the mailing list, often to preserve reputation.

Another reason to use a different Return-Path is the 10-lookup limit in SPF (as SPF is checked on the Return-Path address. Preferably by using a domain that shares the organizational domain used in the Header.From address, to preserve domain alignment (important for DMARC).