The display name is not the address

The header holds two strings

A From header can contain a display name and an addr-spec. The name is the text a client may show in the list. The address is the mailbox, usually inside angle brackets. They are independent. A name that says IT does not make the address an IT mailbox.

If the header has only an address, write “display name absent.” Do not invent a department from the local part.

The preview can hide the address

Some clients show the display name in the message list and leave the address one click away. A note taken from the list alone has not recorded the mailbox. Open the raw header and copy both strings.

Authentication results are a different header. A display name is not spf, dkim, or dmarc. Cite those only from the Authentication-Results line your provider added.

What to write down

File the display name and the address as two fields, plus the time you saved the raw message. If you say “the sender,” say which field you mean. Do not replace the address with the label.

Lab: a list that showed only the label

The mailbox list shows Example IT. The raw From line is Example IT <notices@lab-mail.example>. A draft says the sender is the example.org IT department because the label matches the team name.

The note quotes the label Example IT and the address notices@lab-mail.example. The department claim is not in the header. The address is not rewritten to an example.org mailbox. Authentication is cited only if that header is also in the file.

From: Example IT <notices@lab-mail.example>
display name: Example IT
address: notices@lab-mail.example
list preview: Example IT
write: both strings
not: the example.org IT mailbox