Skip to main content

What does the "From" field mean?

The From field shows who appears to have sent the message. The real technical sender is defined by the envelope MAIL FROM which is what SPF checks. So the visible From can be one thing and the envelope sender can be something else.

There are two parts here. The first part is the friendly from or display name such as Captain Kraken of the Inbox Odyssey. The second part is the actual address such as kraken@tidalmail.com. Phishing attacks often abuse this by keeping the display name familiar while hiding a suspicious domain in the real address.

It is the return address written on the letter. The Return Path which is added later is the harbor post office box where undeliverable mail is sent.