What Is a Return-Path?
The Return-Path is the bounce address: here is how it differs from From and what it does and does not prove.
The Return-Path header holds the envelope sender: the address that receives bounce messages if delivery fails. It is usually the final receiving server that writes it into the message, copying it from the SMTP MAIL FROM command. It is easy to confuse with From and Reply-To, but the three do different jobs.
From, Reply-To and Return-Path compared
| Header | Purpose | Who sets it |
|---|---|---|
| From | The author the reader sees | The sending client or service |
| Reply-To | Where replies are addressed | The sending client or service |
| Return-Path | Where bounces and delivery failures go | Copied from the SMTP envelope by the final receiver |
Why it matters for authentication
SPF checks the domain of the envelope sender, which is the Return-Path domain, against the sending server's IP address. That is why an SPF result reports a domain such as smtp.mailfrom rather than the From address. DMARC then asks whether that domain aligns with the From domain.
From: Example News <[email protected]>
Return-Path: <[email protected]>
SPF checks mail.news.example.com
Relaxed alignment: same organizational domain as news.example.comCommon, legitimate differences
- Email service providers use their own domain or a subdomain for bounces.
- Mailing lists use a list-specific address so bounces reach the list manager, not the author.
- Forwarders may rewrite the envelope sender.
- Bounce messages use an empty <> address.
What it does not prove
Return-Path shows the envelope sender that was used in this transaction. It does not prove who the real sender is, because the person controlling a sending system picks the envelope address. A Return-Path in a different domain than From is an observation worth noting, not evidence of fraud. Look at the Authentication-Results to see whether SPF and DMARC passed.
The Email Header Analyzer lists Return-Path next to From, Reply-To and Sender and shows how their domains relate to the DMARC result.
Sharing a bounce for support?
Return-Path and Received lines include real addresses and IPs. Mask them first with the Log Sanitizer.
Frequently asked questions
- Why is Return-Path different from From?
- They serve different roles. From is the author shown to the reader; Return-Path is the envelope sender for bounces. Newsletters and cloud senders commonly use their own bounce domain.
- Does an empty Return-Path mean something is wrong?
- Not usually. An empty <> return path is used for bounce and delivery-status messages and for some automated mail.
- Is Return-Path the same as Reply-To?
- No. Reply-To tells a mail client where replies go. Return-Path is where delivery failures go.
Try it yourself
The tool that pairs with this guide.
Did this help you tighten your security headers?
If these free developer tools save you time, consider buying me a byte. Your support helps keep DevCraftKit free and growing.
Related articles
HTTP Security Headers Explained: A Practical Developer Guide
A handful of response headers tell the browser how to defend the page they came with. Here's what each one actually does.
Published
Content-Security-Policy (CSP) Explained With Examples
CSP is an allow-list for where your page's resources can load from. Here's how the directives fit together.
Published
What Is HSTS? Strict-Transport-Security Explained
HSTS closes a narrow but real window for downgrade attacks. Here's exactly what it enforces and how to configure it.
Published