The Return-Path is the address a sending server announces during the SMTP conversation, in the MAIL FROM command. It is the envelope sender: the place where bounces and delivery failures are returned. It is set at the transport layer and is distinct from the From header readers actually see.
This matters because SPF authenticates the Return-Path domain, not the visible From. A receiver looks up the SPF record of the MAIL FROM domain to decide whether the sending IP was authorised. For DMARC to pass on SPF, the Return-Path domain must also be aligned with the From domain (the same organisational domain), which is why mismatched envelope domains from some bulk senders cause DMARC to fall back on DKIM.
You can inspect the Return-Path in raw message headers: most receivers stamp a Return-Path: line on delivery. Many email service providers use their own bounce domain here, so check whether they let you configure a custom, aligned Return-Path (a CNAME on a subdomain of yours). Getting alignment right is a core part of the done-for-you enforcement DMARC Engine handles. If bounces vanish or SPF fails unexpectedly, the envelope sender is the first thing to verify.
Check it on your domain
- Email Header Analyser: parses raw email headers and traces the delivery path.
- SPF Checker: validates SPF and counts DNS lookups against the limit of 10.