SMTP MAIL FROM identity used for transport and bounce handling.
Identity and content
Envelope sender
MAIL FROM
SMTP MAIL FROM identity used for transport and bounce handling.
SPF evaluates this domain, and DMARC may compare it with the visible From domain.
It can differ legitimately from the visible From header.