in a Unix mailbox
that indicates the start of a new message
In its basic form
it consists of the string "From", followed by a space, followed by the message sender
and the date
, like this:
From firstname.lastname@example.org Sat Aug 4 07:17:21 2001
Most software that looks for message boundaries looks for any line that begins with the five characters "From ".
Obviously there's a potential ambiguity:
what if the body of the message contains a line beginning with the word "From"?
This potential problem is worked around in two ways:
A "From " line is only treated as a separator if it's preceded by a blank line (or if it's the first line in the mailbox), and
Whenever a message is appended to the mailbox,
if its body happens to contain a blank line followed by a line starting with "From ", that line is altered somehow so it doesn't look like a "From " line.
Usually the line is prefixed by a > character, but occasionally a MIME message using quoted-printable encoding has the F in "From" changed to =46.
Some mail software is overly cautious, and alters lines beginning with "From " even if they're not preceded by blank lines, or alters lines beginning with "from ", too.
Once upon a time, the "From " line in a Unix mailbox was followed immediately by the body text.
(After all, the "From " line contains everything you need to know, right: who it's from and when it arrived. :-) )
Nowadays, the "From " line is followed by the rest of the RFC822 message header, followed by a blank line, followed by the body.
All the other lines in the header, of course, begin with a keyword and a colon, which is why I call the separator lines, "From " lines (with a space inside the quotes).
The originating user name given in the "From " line might not match that in the message's main (RFC822) From: line.
The From: line is relatively easy to forge,
but the "From " line is usually (I think) taken from the SMTP envelope information, which is generally much harder to forge.