How to set up a custom Return-Path (for SPF alignment)

Every email actually carries two “from” addresses. The one your recipients see is the header From:. The one mail servers use for delivery and bounces is the envelope sender — the MAIL FROM in the SMTP conversation, recorded in the Return-Path: header. These are separate, and the distinction is the whole reason this guide exists: SPF authenticates the envelope domain, not the visible From domain.

Why the Return-Path controls SPF alignment

SPF works by checking whether the sending server is authorised for the domain in the envelope-from. When your ESP uses its own bounce domain as the Return-Path, SPF passes — but it passes for the ESP’s domain, not yours. DMARC then applies a second, stricter test: alignment. It asks whether the domain SPF authenticated matches the domain in your visible From:. If SPF authenticated the ESP’s domain and your From is your own domain, they don’t align, and the SPF half of DMARC fails — no matter that SPF itself passed. This is the single most common reason people see “SPF passes but DMARC fails,” explained in full in why SPF passes but DMARC fails.

A custom Return-Path fixes this by moving the envelope-from onto a subdomain you own. Now SPF authenticates your domain, that domain aligns with your From, and the SPF path to DMARC passes. Here’s the relationship laid out:

What alignment looks like in the message envelope:

  MAIL FROM (envelope):  bounces@bounces.example.com   <- Return-Path
  Return-Path:           <bounces@bounces.example.com>
  From:                  news@example.com              <- header From

  SPF authenticates:     bounces.example.com  (the envelope domain)
  DMARC checks:          does the SPF-authenticated domain ALIGN
                         with example.com (the From domain)?  YES,
                         because both share the example.com org domain.

Note that DMARC passes if either SPF or DKIM aligns, so an aligned DKIM signature can carry DMARC on its own. But a custom Return-Path gives you a second aligned mechanism, which makes authentication more resilient — if one path breaks, the other still holds — and it’s required by some setups and BIMI configurations.

How to configure it at your ESP

Nearly every major ESP implements the custom Return-Path the same way: you point a subdomain you own at their bounce infrastructure with a CNAME record, and they handle the rest. The subdomain becomes your envelope-from, so SPF authenticates it and it aligns with your organisational domain.

1. Find the setting. It’s usually part of domain authentication or sender setup — labelled “custom Return-Path,” “custom bounce domain,” “MAIL FROM domain,” or similar. SendGrid, Mailgun, Postmark, Amazon SES, Klaviyo and others all offer it.
2. Choose a subdomain. Something like bounces.example.com or em.example.com under your sending domain. Keeping it under your organisational domain is what makes it align.
3. Add the CNAME the ESP gives you. The ESP shows an exact host and target. Publish that CNAME in your DNS. The pattern looks like this — but always use the precise values your ESP displays:

Typical custom Return-Path CNAME (values vary by ESP):

  Type   Host / Name          Value / Target
  CNAME  bounces.example.com   pm.mtasv.net          (Postmark)
  CNAME  em.example.com        u1234.wl.sendgrid.net (SendGrid)
  CNAME  bounce.example.com    mailgun.org           (Mailgun)

Use the exact host and target your ESP shows you. Point a
subdomain you own (e.g. bounces.example.com) at the ESP's
bounce host so it becomes the envelope-from / Return-Path.

Because it’s a CNAME to the ESP, they can publish and rotate the underlying SPF/bounce records for you, so you don’t have to maintain them by hand. On Amazon SES the equivalent is a “custom MAIL FROM domain,” which uses an MX and TXT record instead of a single CNAME — the principle is identical.

How to verify it aligns

After DNS propagates (minutes to a few hours), confirm two things. First, that the ESP reports the custom Return-Path as verified in its dashboard. Second — and this is what actually matters — that a real message now aligns. Send a test and check the results, or run your domain through the Email Health Check and confirm your policy with the DMARC Checker. In the Authentication-Results header of a delivered message you want to see spf=pass and the SPF domain sharing your organisational domain, giving DMARC an aligned SPF pass. If SPF still authenticates the ESP’s domain, the Return-Path change hasn’t taken effect — recheck the CNAME.

Common mistakes

• Confusing Return-Path with From. Changing your visible From address does nothing for SPF alignment. It’s the hidden envelope-from you need to move.
• Using a subdomain on a different domain. The Return-Path subdomain must sit under the same organisational domain as your From, or it won’t align.
• Proxying the CNAME. If your DNS host has a proxy/CDN toggle (Cloudflare’s orange cloud), keep the bounce CNAME DNS-only, or it won’t resolve to the ESP.
• Assuming DKIM covers it. DKIM alignment can pass DMARC alone, but a broken DKIM signature with no aligned SPF leaves you failing DMARC entirely. The custom Return-Path is your safety net.

Sources

The distinction between the envelope sender and the header From is defined in RFC 5321 (SMTP, the envelope) and RFC 5322 (the message header). SPF is specified in RFC 7208, and the DMARC alignment rules that make the Return-Path matter are in RFC 7489.