RFC 5321 — SMTP

RFC 5321 defines SMTP, the protocol that actually moves mail between servers. It obsoletes RFC 2821, which obsoleted RFC 821 from 1982.

For email authentication its importance is one specific thing: it defines the envelope, and the envelope is not the message.

The envelope and the message

An SMTP transaction carries two addresses that are easy to conflate and mean different things:

	Defined by	Also called	Who sees it
MAIL FROM	RFC 5321 (this)	envelope sender, Return-Path, RFC5321.MailFrom	Servers, bounce handling
From:	RFC 5322	header From, RFC5322.From	The recipient

Nothing in SMTP requires them to match, and for perfectly legitimate mail they often do not — a mailing list sends with its own bounce address while preserving your From:.

Why DMARC exists because of this

SPF authenticates MAIL FROM. It is defined against the envelope and has nothing to say about the header.

So a message can pass SPF completely while displaying any From: the sender likes. For years that was the whole attack: authenticate an envelope on a domain you control, display a From: on a domain you do not. Both halves are valid SMTP.

DMARC closes it by requiring that whichever mechanism passes must also align with RFC5322.From. That single requirement is why DMARC works where SPF and DKIM alone did not.

The other thing SMTP gives you

Bounces go to MAIL FROM, not to From:. This is why a misconfigured Return-Path sends delivery failures somewhere nobody reads, and why the address your bulk platform uses for bounces is usually its own domain rather than yours — which is fine for delivery and precisely what breaks SPF alignment under DMARC.

Read it: rfc-editor.org/rfc/rfc5321