What’s the difference between envelope-from and header-from?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Picture a physical letter. The address on the envelope is what the postal service uses for delivery and returns. The address written inside is what the recipient reads. Email works exactly the same way, just with different names: the envelope-from (also called the return-path or MAIL FROM) is the delivery address, and the header-from is the visible From field your subscriber sees in their inbox.
These two addresses can be completely different domains. Your header-from might be hello@yourbrand.com, while your envelope-from is bounces.youresp.com. That's normal. Your ESP handles the technical plumbing of bounce processing using their own infrastructure. But the difference matters for authentication: SPF checks against the envelope-from domain, while the header-from is what your subscribers see and what DMARC uses as its reference point. When the two domains don't align, DMARC can fail even if SPF passes.
The concept of DMARC alignment exists precisely because of this split. A strict DMARC policy requires the envelope-from domain to match (or be a subdomain of) the header-from domain. Relaxed alignment allows subdomain matches. Most senders on shared ESP infrastructure use relaxed alignment and rely on DKIM for the identifier alignment that satisfies DMARC. Because DKIM signs against the header-from domain directly.
Setting up a custom sending domain in your ESP closes the gap between envelope-from and header-from by putting both under your brand's domain hierarchy. It's not required for delivery, but it cleans up your authentication picture and makes your DMARC reporting easier to interpret. Most ESPs implement this via a CNAME record in your DNS pointing to their bounce infrastructure.
If you're troubleshooting failed DMARC alignment or seeing authentication warnings in email headers, the mismatch between envelope-from and header-from is usually the first place to check. Use Review My Emails' SPF and DKIM checker to see exactly what domains are in play on your outgoing mail.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
