Postmark 400 "From address is not a Sender Signature": fix it

What it means

Postmark only sends from addresses you have proven you own. Your message used a From address that is not confirmed in your account, so Postmark refused it. The API answer usually looks like this (HTTP status 422):

{
  "ErrorCode": 400,
  "Message": "The 'From' address you supplied (info@yourdomain.com) is not a Sender Signature on your account. Please add and confirm this address in order to be able to use it in the 'From' field of your messages."
}

In the Activity tab or other tools, the same problem can appear as "Sender Signature not defined for From address."

Postmark has two ways to approve a sender:

• Sender Signature: one exact address, confirmed by clicking a link Postmark sends to that mailbox.
• Domain: you verify the whole domain with DNS records. Then any address at that domain can be used as From.

Why it happens

• The signature was added but never confirmed. The confirmation email went to an inbox nobody reads, or to spam.
• Your code uses a different address from the one you confirmed, for example noreply@ instead of hello@. A single-address signature only covers that exact address. The display name ("Shop <hello@yourdomain.com>") does not matter, only the address.
• Subdomain mismatch. A domain verified as yourdomain.com does not automatically cover mail.yourdomain.com, and the reverse is also true. Add the exact domain you send from.
• A plugin or framework overrides the From address, for example WordPress using wordpress@yourdomain.com, or a contact form putting the visitor's address in From. See contact form emails sent "From" the visitor's address.
• Wrong account or server token: the signature exists in another Postmark account.

How to check

1. Log the exact From address your application sends (not what you think it sends).
2. In Postmark, open Sender Signatures. Check whether that exact address or its exact domain is listed, and whether it is confirmed or verified.
3. For a domain, open its DNS settings in Postmark and see whether DKIM and Return-Path show as verified.
4. Scan your domain with the Delivmail domain scanner to see the SPF, DKIM and DMARC records that are really published.

How to fix it

Quick fix: confirm one address

In Sender Signatures, add the exact From address your code uses, then click the link in the confirmation email Postmark sends to it. Make sure the mailbox exists and can receive mail. You can send from it right after confirmation.

Better fix: verify the domain

1. In Sender Signatures, add your domain.
2. Postmark shows a DKIM TXT record. Copy the host name and value exactly as displayed; the host ends in ._domainkey. It looks like:

   Host:  <name shown by Postmark>._domainkey.yourdomain.com
   Type:  TXT
   Value: k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA...

3. Add the record at your DNS host. Many DNS panels add the domain automatically, so you may need to enter only the part before yourdomain.com; see DNS record added at the wrong name.
4. Click Verify next to DKIM in Postmark.
5. Set up the custom Return-Path too. This is covered in Postmark custom Return-Path and DMARC alignment.

With a verified domain, Postmark signs your mail with your own domain, which also lets DMARC pass. A single confirmed address without DKIM can send, but your mail is not signed with your domain, which hurts deliverability.

Fix the application

• Set the From address in one place (environment variable or config) and use it everywhere.
• For contact forms, keep your own address in From and put the visitor in Reply-To.
• Never use a free-mail address (Gmail, Outlook) as From through Postmark: you cannot verify those domains, and their DMARC policies make such mail fail.

Check that it is fixed

Send a message from your application to the unique address on the Delivmail home page. If Postmark accepts it, the report appears; check that DKIM passes with your domain (d=yourdomain.com) and that DMARC passes. Then resend the original message. DNS changes can take from a few minutes to several hours to be visible, so wait and click Verify again if Postmark does not see the DKIM record yet.