What’s the difference between visible and authenticated identity?

Picture this: you get an email from "Harbor Shipping Co." That name shows up in your inbox, clear as day. But behind the scenes, the mail server that sent it belongs to a completely different domain. Which one does your inbox actually trust?

That's the gap between visible identity and authenticated identity, and it's worth understanding both.

Visible identity is everything a recipient can see: the From name, the From address, and how the sender presents themselves inside the email client. It's the human-facing side of who sent the message.

Authenticated identity is what's verified in the background through SPF, DKIM, and DMARC. These protocols confirm which domains were actually authorized to send the message and whether the content was signed by a legitimate source. Inbox providers like Gmail and Outlook check this automatically, and your recipients never see it happen.

Here's the thing: the two can easily diverge. An email might display "captain@deepcurrent.io" in the From field but authenticate under a third-party sending domain that has nothing to do with deepcurrent.io. Visually, everything looks fine. Technically, nothing aligns.

That's exactly why DMARC alignment exists. It requires the authenticated domain (from SPF or DKIM) to match the visible From domain. When they do match, inbox providers can confirm that the sender is who they claim to be. When they don't, you're at higher risk of being flagged or filtered (or impersonated by someone else entirely).

If you want to check whether your visible and authenticated identities are actually lining up, our free Email Header Analyzer can show you exactly what's happening behind the scenes. Or if things feel complicated, drop us a message via the SOS hotline and we'll take a look with you.