Return-Path, envelope sender and From: why they must match your domain

What it means

An email is a bit like a letter in an envelope. It has two sender addresses:

• The From address, printed on the letter. It is what the reader sees, for example news@yourdomain.com.
• The envelope sender, written on the envelope. It is used by servers, mostly to send back bounces (undelivered email notices). Once delivered, it is saved in the Return-Path header. It is also called "MAIL FROM" or "bounce address".

They can be different. Newsletter tools often use their own envelope sender, such as bounce-123@mail.sendingtool.com, so they can process bounces for you.

Why it matters

• SPF checks the envelope sender, not the From. If the Return-Path is on the tool's domain, SPF passes for the tool, not for you.
• DMARC checks the From. It passes only if SPF passes for a domain that matches the From domain, or DKIM passes for a domain that matches it. This is called alignment.
• So with a tool's Return-Path and the tool's own DKIM signature, everything "passes", but DMARC fails for your domain.

How to check

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report. In the authentication section, compare the domain checked by SPF, the DKIM signing domain (d=) and the From domain. The report shows whether each one is aligned. In the "Raw headers" section, look at the Return-Path line.

Return-Path: <bounce-123@mail.sendingtool.com>   (not aligned)
Return-Path: <bounces@mail.yourdomain.com>       (aligned)
From: News <news@yourdomain.com>

A subdomain of your domain, like mail.yourdomain.com, counts as aligned in the default "relaxed" mode.

How to fix it

1. Set up DKIM with your own domain first. In each sending tool, look for "domain authentication" or "custom DKIM". Add the records it gives you. Aligned DKIM is enough for DMARC to pass, and it survives forwarding better than SPF.
2. Set up a custom Return-Path if your tool offers it. It is often called "custom bounce domain", "custom MAIL FROM" or "return-path domain". You usually add a CNAME record such as bounces.yourdomain.com pointing to the tool.
3. For your own server, make sure the envelope sender uses your domain and that the server's IP address is in your SPF record.
4. For website forms and scripts, set the envelope sender explicitly. Many web hosts use a default like user@server123.host.com. In PHP mail, the -f parameter or the library's "Sender" setting controls it.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Send a new test email from the home page through the same tool. The report should show DKIM passing and aligned for your domain, and ideally SPF aligned too, with DMARC passing.