The envelope sender is the MAIL FROM identity used by SMTP during message delivery. It is part of the transport layer, not the message shown to users, so it can differ from the visible From header. SMTP also allows a null reverse-path, written as MAIL FROM:<>, for certain legitimate mail such as bounce handling. That makes the field flexible, but also easy to misunderstand.
In cyber security, the envelope sender matters because mail defenses often evaluate it alongside headers and authentication results. SPF checks the sending domain against the envelope identity, while DMARC and DKIM help judge whether the visible sender is aligned and trustworthy. Attackers may try to exploit gaps between these layers to make phishing or spoofed mail look internal or routine. Defenders should compare the envelope sender, header sender, and mail-authentication verdict together, rather than trusting any single field.