Postmark custom Return-Path (pm-bounces) and DMARC alignment

What it means

Every email has two sender addresses. The From address is what the reader sees. The Return-Path (or envelope sender) is a hidden address where bounces go. SPF checks the domain of the Return-Path, not the From. For a refresher, see Return-Path, envelope sender and From.

By default, Postmark uses its own bounce address:

Return-Path: <pm_bounces@pm.mtasv.net>

SPF passes, but for pm.mtasv.net, not for your domain. DMARC needs SPF or DKIM to pass for a domain that matches your From domain (this is called alignment). With the default Return-Path, SPF does not align, so DMARC relies only on DKIM.

A custom Return-Path replaces it with a subdomain of your own domain, by default pm-bounces.yourdomain.com:

Return-Path: <pm_bounces@pm-bounces.yourdomain.com>

SPF then passes and aligns with your domain, so DMARC can pass on both SPF and DKIM.

Why it happens

You see "SPF not aligned" or a DMARC warning in a report because:

• The custom Return-Path was never set up (it is optional in Postmark).
• The CNAME was added, but the alias was not entered or verified in Postmark, so Postmark still uses its default.
• The CNAME is wrong: wrong name, wrong target, or proxied by Cloudflare.
• Your DMARC record uses strict SPF alignment (aspf=s). Strict mode requires the exact same domain, and pm-bounces.yourdomain.com is a subdomain, so SPF alignment fails even with a correct setup. See DMARC tags explained.

If DKIM also fails, DMARC fails completely; that is a different problem, covered in DMARC fails: SPF and DKIM do not match your domain.

How to check

1. Send an email through Postmark to the unique address on the Delivmail home page. In the report, look at the SPF domain (the Return-Path) and the DMARC result.
2. Check the record from a terminal:

   dig +short CNAME pm-bounces.yourdomain.com
   pm.mtasv.net.

   If the answer is empty or shows IP addresses, the CNAME is missing or proxied.
3. In Postmark, open Sender Signatures, choose the domain and open DNS Settings. The Return-Path section shows whether it is verified.

How to fix it

1. Add the CNAME at your DNS host:

   Host:   pm-bounces.yourdomain.com   (enter "pm-bounces" in most DNS panels)
   Type:   CNAME
   Value:  pm.mtasv.net

   You can choose another label, but it must be a subdomain of your From domain and must not already have other records (a CNAME cannot share its name with TXT, MX or A records; see CNAME conflicts with MX and TXT records).
2. Cloudflare users: set the record to "DNS only" (grey cloud). A proxied record does not return the CNAME. See Cloudflare proxied records break email.
3. Tell Postmark: in Sender Signatures, open the domain's DNS Settings, go to the Return-Path section, enter the same alias (for example pm-bounces) and verify it.
4. Do not add Postmark to your main SPF record for this. SPF is checked on pm-bounces.yourdomain.com, which inherits Postmark's SPF through the CNAME. Your root SPF record stays as it is.
5. Check DMARC alignment mode. Keep the default relaxed mode (aspf=r, or no aspf tag) unless you have a reason to be strict.
6. Keep DKIM verified as well. Two aligned methods are safer than one, because DKIM survives some forwarding cases where SPF breaks. If DKIM is not set up yet, see Postmark Sender Signature and domain verification.

Several From domains

The custom Return-Path is set per domain. If you send from yourdomain.com and news.yourdomain.com, each needs its own verified setup in Postmark.

Check that it is fixed

Wait until the CNAME is visible (minutes to a few hours depending on your DNS host), confirm it is verified in Postmark, then send a new test to Delivmail. The Return-Path should now end in pm-bounces.yourdomain.com, SPF should pass, and DMARC should pass with both SPF and DKIM aligned. You can also check the Authentication-Results header of a message received in Gmail: look for spf=pass with smtp.mailfrom=pm-bounces.yourdomain.com and dmarc=pass.