From address does not match envelope sender
Your visible From: address differs from your envelope (Return-Path:) address in ways that look like spoofing to receivers.
This is one of the primary signals Gmail and M365 use to detect phishing. Even legitimate senders get flagged if the From/Return-Path mismatch isn't properly explained via DMARC alignment.
What causes it
- You're sending via a 3rd-party service (newsletter platform, CRM) that uses its own bounce-handling domain as the Return-Path.
- A mail list software rewrote the Return-Path for VERP/bounce tracking without updating DKIM alignment.
- You intentionally spoofed the From for a legitimate use case (sending on behalf of a client) without configuring sender authentication.
How to fix it
Step 1: Understand the receiver's view
From: = what the user sees. Return-Path: = where bounces go. These can differ, but DMARC requires either SPF alignment (Return-Path matches From) OR DKIM alignment (DKIM d= matches From) for the mail to be trusted.
Step 2: Fix via DKIM alignment
For most 3rd-party senders, SPF alignment is impossible (they need their own bounce domain). But DKIM signing with YOUR domain is almost always possible. Set up a verified sending domain in your service's dashboard with your own DKIM selector.
Step 3: Verify with a test send
Send a test to InboxGrade and check the DMARC alignment section. If dkim=pass and dkim-align=pass with d= matching your From domain, you're good.
Fixed it? Run a fresh test to confirm.
Test my inbox →