How to Identify the Two Email “From” Header Lines

Understand the Two “From” Email Headers

Did you know that every email has two kinds of senders? They are usually identical, but they can be different as well. Find out here how to identify and understand the two kids of email “From” header lines.

First, Sing Along, If You Will

Sing along, if you will, with the traditionally puzzling Italo-disco lyrics: But tell me if the sky is blue, how old are you?

For we are in East Asia today, and traditional age is our concern. In Korea, Japan and China among many places more, your age at birth would be one year instead of the slightly puzzling zero. That number of years would increase by one on the next New Year’s Day—for everybody, no matter their birthday. (So, yes, a baby born two days ago could also, at the same time, be two years old.)

Now that we know the two ways of establishing a person’s age, let’s turn to the two ways of establishing an email’s sender:

How to Understand the Two Kinds of Email “From” Header Lines

To understand how every email has two kinds of “From” senders in its header lines, let’s first differentiate the email itself from its delivery process, then the email’s content from its header.

The Email From: Header

What you see when you open a message in an email program like iPhone Mail or an email service such as Gmail is the email content (body) and a few select lines from its envelope (header), such as the recipient, subject and sender.

That first sender is the From: line in the header. It will usually have been set by the email’s sender to their email address.

The SMTP From: Header

During the process of email delivery, email servers and programs talk to each other using SMTP, the simple mail transfer protocol. In that conversation, the sending program specifies the sender using an email address in the MAIL FROM: command (and then recipients using the RCTP TO: command).

The MAIL FROM: sender can and often will correspond to the From: sender in the email header, but the two crucially do not have to be identical. (Similarly, the RCPT TO: recipients need not be the same as those in the email header’s To:, Cc: and Bcc: lines.)

How to Identify the Two Kinds of Email “From” Header Lines

Time needed: 3 minutes

To find both the From: header sender and the SMTP FROM: sender for an email:

  1. Open the full email header for the email whose From senders you want to establish.

  2. Look for the first line from the top that starts with Return-Path:.

    SMTP From: The email address that follows Return-Path: is the SMTP From sender.

  3. Look for the first line from top that starts with From:.

    Email From: The email address following From: as a header line is the sender that will appear in the From: line in an email program.
    Finding the SMTP MAIL FROM (Return-Path:) header in an email source

How to Identify and Understand the Two Kinds of Email “From” Header Lines: FAQ

Is there a Regex I can use?

Yes.

You can use the following regular expression (applied globally) to find lines beginning with either From: or Return-Path: in an email’s source code or header lines.

^(From|Return-Path):.*$

This will match lines in the email body that start with either of these keywords as well. Concocting an expression that will only match within the header and works with all kinds of regular expression engines seems more effort that it is worth.

What’s the use of the SMTP From header?

The SMTP From header is used to

  • identify the sender and domain for which the SPF (Sender Policy Framework) records are checked and matched, for example, and to
  • send delivery failure messages; these go to the Return-Path address instead of the From: header address.

(How to identify the two kinds of email “From” header lines updated April 2024)

Home » Email Tips and Resources » How to Identify the Two Email “From” Header Lines