Trouble with SPF and Return-Path Headers in Postfix Email Setup

Question

I'm facing an issue with sending emails using my Postfix MTA (sender.domain.com) and could use some guidance. My goal is to send emails from [email protected]. However, I'm encountering SPF-related problems and inconsistencies in how email clients display the sender's address.

Here's the detailed scenario: When I connect to my MTA on port 25 and set the following headers:

From: [email protected] Return-Path: [email protected]

The email fails due to SPF checks as sender.domain.com isn't included in the SPF records. Additionally, the Return-Path header seems to disappear by the time the email reaches its final destination.

But if I change and send this headers: From: [email protected] Return-Path: [email protected] Sender: [email protected]

SPF checks pass since sender.domain.com is included in the SPF records. However, some email clients display the From address as [email protected], while others display it correctly as [email protected].

My Questions:

What could be causing the Return-Path header to disappear in the initial setup? Why do some email clients display the From address differently in the modified setup? Is there a way to configure my Postfix setup so that SPF checks pass without affecting the display of the From address in various email clients?

Answer 1

As a sender, it's not up to you to set a return-path; that's the receiver's job. Setting it when sending is an RFC contravention. The address it uses is obtained from the SMTP MAIL FROM address, not within the message. It's likely that the address you're putting in the message is being replaced with the MAIL FROM address that the server is configured to use.

The right solution to this is to not set the return-path yourself, add the MAIL FROM domain to your SPF, and to use DMARC to validate the From address in your message. You may notice that it's tricky to get DMARC alignment right when you are sending through third parties, and you have my sympathies... That can be solved with subdomains and CNAMEs, but it's not pretty.

Mail clients should not usually display the return path unless you explicitly show headers.