Label each identity by purpose

The RFC 5322 From field identifies the author presented in the message. It is usually what a recipient sees, and its domain is the starting point for DMARC. Reply-To, when present, asks mail clients to direct replies somewhere other than the author address. The SMTP reverse-path carries delivery-status information; after delivery it is commonly represented by a Return-Path field added by the final delivery system.

Use a table for one message:

Role Illustrative value Operational use
Visible From receipts@example.com Author identity and DMARC From domain
SMTP MailFrom / Return-Path bounces@bounce.example.net SPF identity and bounce handling
Reply-To support@example.com Destination selected when a person replies
DKIM d= example.com Signing domain that may satisfy DMARC alignment

These example domains are reserved for documentation. Your provider may use a default return-path domain until you configure a custom one.

Follow the authentication relationship

SPF evaluates the SMTP identity and connecting IP; it does not authenticate the display name or automatically validate the visible From domain. DKIM verifies a signature associated with its d= domain. DMARC compares the visible From domain with a passing SPF or DKIM domain according to alignment rules.

That is why SPF can pass for bounce.example.net while DMARC uses an aligned DKIM signature from example.com. It is also why changing Reply-To does not repair SPF or DMARC.

Check the configured behavior

Send a fresh authorized message through each legitimate stream. Record the four identities, receiver-added authentication results, and the system that owns each setting. Test a reply separately to confirm that Reply-To behaves as intended. Confirm that bounces reach the service designed to process them; do not send real failures to an unmonitored mailbox merely to make the domains look alike.

Avoid cosmetic fixes

Choose identities that support clear ownership, reliable bounce processing, and truthful alignment. Do not copy a domain into every field without understanding the provider’s verification and routing requirements. The configuration is complete when each address has an owner, a purpose, and receiver evidence from a fresh message—not when the header strings merely look consistent.