What is MAIL FROM?

Think of a paper envelope. MAIL FROM is the return address written on the outside, used by the postal system. The From header is the letterhead inside, which is what the reader looks at.

Bounces go to the envelope address, which is why sending platforms set it to something like bounces-1a2b3c@mail.yourdomain.com. That unique string tells them which message failed when the report arrives.

SPF evaluates this address and no other. A perfect SPF pass on your envelope domain says nothing about the From header, and DMARC alignment exists precisely to require the two to relate.

A null sender, written MAIL FROM:<>, marks a bounce notification. It has to be empty so that a failed bounce cannot bounce in turn and start a loop.

The envelope is gone by the time you read an email, but the final server copies the sender into a header before it files the message. Open the source of any marketing email and find Return-Path. You'll see something like <bounces+48213-7f3a-jane=example.org@em.brand.example>, while the From line reads hello@brand.example.

That long address is doing a job. The technique is called VERP, and it packs a campaign number and the recipient's own address, with the at-sign swapped for an equals sign, into the local part. When a bounce comes back weeks later as a badly formatted note from some old server, the platform doesn't need to parse it. The address the bounce was sent to already says who failed.

Notice the domain too. Here em.brand.example is a subdomain the brand delegated to its platform. On accounts without that setup, the return path sits on the platform's own domain.

SPF is checked against the MAIL FROM domain. If that domain belongs to your sending platform, SPF passes for them, and DMARC then asks whether the domain that passed matches your From address. It doesn't, so SPF contributes nothing to your DMARC result and everything rides on DKIM.

That works until the day it doesn't. A forwarding hop that alters the message, or a key rotation that goes wrong, takes out DKIM, and you've got no second leg to stand on. Setting up a custom return path, usually one CNAME record, gives you aligned SPF as the backup.

Receivers may also test the envelope sender during the conversation. Some refuse a MAIL FROM whose domain doesn't resolve, and some evaluate SPF right there and reject with a 550 before any recipient is named. A refusal at that stage concerns the sender and tells you nothing about the mailbox you were going to ask for.