The Header From, formally RFC5322.From, is the From: line in the message body that mail clients display to the recipient. It is the human-facing identity of the sender and the address most people judge a message by.
It is deliberately separate from the Return-Path (the SMTP envelope sender, RFC5321.MailFrom). A message can carry one domain in the envelope and a different one in the visible From, which is exactly how much spoofing works. DMARC exists to close that gap: it requires the Header From domain to align with an authenticated identity. A message passes DMARC only when SPF or DKIM passes and the verified domain matches the Header From domain.
Because alignment is anchored to the Header From, a single message must contain exactly one From address; multiple From values or a malformed header break DMARC evaluation. Display-name tricks, where the visible name looks legitimate but the actual address does not, target readers who never inspect the real From domain. To check yours, open the raw headers and confirm the From domain matches your authenticated sending domain. DMARC enforcement protects this field across every legitimate sender you use.
Check it on your domain
- Email Header Analyser: parse raw email headers and trace the delivery path.
- DMARC Checker: look up and validate a domain's DMARC record and policy.