The Return-Path (envelope sender) is the email address where bounces are sent. For DMARC SPF alignment, the Return-Path domain must match your From: domain. Most ESPs set Return-Path to their own domain by default (e.g., bounce.sendgrid.net), which breaks SPF alignment. Fix: configure a custom Return-Path domain in your ESP (e.g., bounce.yourdomain.com) by adding a CNAME record. This enables SPF alignment for DMARC without relying solely on DKIM.
Return-Path Domain Configuration for Email
Return-Path is part of your broader email authentication and DNS configuration.
How Return-Path Works
Visible to recipient:
From: [email protected]
Hidden in headers (set by sending server):
Return-Path: [email protected]
SPF checks Return-Path domain: bounce.sendgrid.net
SPF passes for SendGrid's IPs ✓
But DMARC alignment fails because bounce.sendgrid.net ≠ yourdomain.com ✗
With custom Return-Path:
Return-Path: [email protected] (CNAME → SendGrid)
SPF checks Return-Path domain: bounce.yourdomain.com → resolves to SendGrid IPs
SPF passes ✓
DMARC SPF alignment passes (bounce.yourdomain.com aligns with yourdomain.com) ✓
ESP Configuration
SendGrid
Settings → Sender Authentication → Link Branding
Add CNAME: bounce.yourdomain.com → SendGrid's bounce endpoint
Mailgun
When verifying a domain, Mailgun provides a CNAME for bounce/tracking. Add it to DNS. This sets the Return-Path to your domain.
Postmark
Automatic. When you verify your domain in Postmark, Return-Path is configured to use your domain. No additional setup needed.
AWS SES
SES uses a MAIL FROM domain. Configure in SES → Verified Identities → Your Domain → Custom MAIL FROM domain. Add MX and SPF records for the subdomain.
When to Prioritize This
High priority if: Your DKIM is inconsistent or you want maximum authentication robustness.
Lower priority if: Your DKIM alignment is solid (d= matches your From: domain). DKIM alignment alone satisfies DMARC.
Always recommended: Belt-and-suspenders authentication. Both SPF and DKIM aligning gives the strongest DMARC pass. See our email deliverability guide for more on how authentication affects inbox placement.
Practitioner note: Custom Return-Path is the authentication detail most people miss. Your ESP's default Return-Path uses their domain, which means SPF alignment always fails for DMARC. Most of the time DKIM saves you. But if DKIM ever fails (key rotation, DNS issue), having SPF alignment as backup prevents a complete DMARC failure.
If you need full authentication architecture configured, schedule a consultation.
Sources
- RFC 5321: SMTP (Return-Path/MAIL FROM)
- RFC 7489: DMARC (Alignment)
v1.0 · March 2026
Frequently Asked Questions
What is the Return-Path header?
The Return-Path (also called envelope sender or bounce address) is where the receiving server sends bounce notifications. It's set by the sending server and is separate from the visible From: address. SPF checks the Return-Path domain, not the From: domain.
Why does Return-Path matter for DMARC?
DMARC requires alignment between authentication and the From: domain. SPF checks the Return-Path domain. If Return-Path is bounce.sendgrid.net but From: is [email protected], SPF passes for SendGrid's domain — but DMARC SPF alignment fails because the domains don't match.
Do I need custom Return-Path if I have DKIM?
Not strictly — DMARC passes if EITHER SPF or DKIM aligns. If DKIM aligns with your From: domain, DMARC passes even without SPF alignment. Custom Return-Path provides belt-and-suspenders: both SPF and DKIM align. Recommended but not critical if DKIM is solid.
How do I set up custom Return-Path?
Most ESPs call this 'custom bounce domain' or 'link branding.' Add a CNAME record: bounce.yourdomain.com → your ESP's bounce domain. SendGrid: Settings → Sender Authentication → Link Branding. Mailgun: Domain Settings → add the tracking/bounce CNAME. Postmark: auto-configured on domain verification.
Does Postmark handle Return-Path automatically?
Yes. Postmark automatically sets Return-Path to your verified domain when you add it. This is one of Postmark's advantages — SPF alignment works out of the box without additional configuration.
Want this handled for you?
Free 30-minute strategy call. Walk away with a plan either way.