Could there be a Sender header that was being verified instead of the From? Is that how it works? What about envelope From? Which of those are even protected by

Could there be a Sender header that was being verified instead of the From? Is that how it works? What about envelope From? Which of those are even protected by DKIM/SPF?