Authentication
Return-Path
The address bounce notifications are sent to, which can differ from the visible "From" address — used by receiving servers to route delivery failures.
Envelope sender vs. From address
Every email has two senders. The From header is what the reader sees. The envelope sender, recorded as the Return-Path header on delivery, is where the receiving server sends bounces and delivery failures.
Email platforms usually set the Return-Path to an address they control, so they can process bounces automatically and suppress bad addresses for you.
Why it matters for authentication
SPF checks the Return-Path domain, not the From domain. For SPF to count toward DMARC, the Return-Path domain has to align with your From domain, which is why many platforms let you use a custom bounce subdomain such as bounces.yourdomain.com.
If the Return-Path belongs to your provider instead, DMARC can still pass through DKIM alignment, which is why DKIM signing with your own domain matters so much.
Let MailCraft handle the details
Authentication, bounces, complaints and suppression are built in. Start free with 3,000 emails a month, no credit card required.
Start freeRelated terms
Full glossaryAuthentication
SPF (Sender Policy Framework)
A DNS TXT record listing which mail servers are authorized to send email on behalf of your domain. Receiving servers check it to catch spoofed senders.
Authentication
DMARC
A DNS policy that tells receiving servers what to do with mail that fails SPF/DKIM alignment (none, quarantine, or reject), and provides aggregate reports on who’s sending as your domain.
Sending & delivery events
Hard bounce
A permanent delivery failure — the address or domain doesn’t exist. Hard bounces should be suppressed immediately and never retried.