From (envelope)

The from field is in most FortiMail log messages where:

• type=statistics

• type=spam

• type=virus

It indicates the sender email address in the SMTP envelope (MAIL FROM:), which may be different from the email message header in some normal use cases such as mail aliases.

This field is empty if session_id is empty, for returned mail, or when a DKIM key could not be retrieved from the DNS server.