'/%3e%3ccircle%20cx='100'%20cy='100'%20r='84'%20fill='%23093e47'/%3e%3ccircle%20cx='100'%20cy='100'%20r='79'%20fill='url(%23teal)'/%3e%3cg%20transform='translate(55,55)'%20stroke='url(%23cmd)'%20stroke-width='11'%20fill='none'%20stroke-linecap='round'%20stroke-linejoin='round'%3e%3crect%20x='27'%20y='27'%20width='36'%20height='36'%20rx='5'/%3e%3ccircle%20cx='13.5'%20cy='13.5'%20r='13.5'/%3e%3ccircle%20cx='76.5'%20cy='13.5'%20r='13.5'/%3e%3ccircle%20cx='13.5'%20cy='76.5'%20r='13.5'/%3e%3ccircle%20cx='76.5'%20cy='76.5'%20r='13.5'/%3e%3c/g%3e%3c/svg%3e)
The envelope sender is the return address specified during the SMTP conversation with the MAIL FROM command, not the From line a recipient sees. It functions like the return address on a physical envelope: it tells the mail system where to send the letter back if delivery fails. It is also called the Return-Path or bounce address.
A crucial point is that the envelope sender and the header From address are two separate things and often differ. Marketing platforms and mailing lists routinely set the envelope sender to their own bounce-handling address while displaying your brand in the From line, so that failure notices route to their systems for processing.
This distinction is central to email authentication. SPF checks the envelope sender's domain against the sending IP, not the visible From address — which is exactly the gap DMARC closes by requiring alignment between the two. Understanding which address each mechanism inspects is key to diagnosing authentication failures.
For senders, the envelope sender is where bounces and delivery status notifications arrive, making it the linchpin of list hygiene automation. Systems that process bounces to suppress bad addresses rely on receiving those notices at the envelope sender address, so it must point to a monitored, deliverable mailbox.