The envelope and the message

An email has an envelope and a message. They are related, but they are not the same data.

SMTP commands create the envelope. MAIL FROM supplies the return path and one or more RCPT TO commands name envelope recipients. The message begins later, after DATA, and contains visible fields such as From, To, and Subject.

This separation makes forwarding, mailing lists, and blind copies possible. It also explains why debugging delivery starts with the envelope, while debugging what a user sees starts with the message headers.

Here is one complete distinction:

C: MAIL FROM:<bounces@news.example>
C: RCPT TO:<bob@example.net>
C: DATA
C: From: Alice <alice@example.org>
C: To: team@example.org
C: Subject: Private preview
C:
C: The release is ready.

The server routes toward bob@example.net. The reader sees alice@example.org and team@example.org. That is normal for a mailing list or blind copy. It is also why the visible From field alone does not identify the authenticated submitting account.

After final delivery, the receiving system can record the reverse path in Return-Path. Transport systems also prepend Received fields. Those fields become message trace data, but they do not change which envelope was used during the earlier SMTP transaction.

Take a saved .eml file and find From, To, Return-Path, and the oldest Received field. Write down which values came from the message and which describe transport.