Amazon SES custom MAIL FROM

Amazon SES: Return-Path does not match the configured custom MAIL FROM domain

A custom SES MAIL FROM domain should be visible in a newly sent message's Return-Path. Compare that identity with the configured subdomain, then inspect MX and SPF at that exact DNS name.

Problem description

A sent message appears to use a different Return-Path than the configured SES custom MAIL FROM domain:

Return-Path does not match the configured SES custom MAIL FROM domain.

Run this automated test on my domain

Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.

Required evidence: paste only the complete message headers and enter the custom MAIL FROM subdomain configured in SES. MailFixIt extracts a normalized Return-Path domain; it does not return raw headers.

What the diagnostic reports

Observed identity: whether the supplied message's Return-Path domain matches the configured custom MAIL FROM domain.
Current DNS: MX and SPF state at the configured custom MAIL FROM subdomain, separate from apex inbound mail records.
Bounded conclusion: a mismatch is message-header context, not proof of the SES fallback setting or of a sender-side fault.

Safe investigation sequence

Confirm that the message was sent through the SES identity and Region that owns the custom MAIL FROM setting.
Compare the observed Return-Path and configured custom MAIL FROM domain exactly.
Verify the SES-issued MX target and SPF publication at the custom subdomain.
Review the selected SES behavior for MAIL FROM MX failure in the console.
Send a fresh message after any verified correction and inspect new headers.

DNS results do not prove SES has refreshed its verification state, and a matching Return-Path does not independently verify SPF/DKIM alignment.

Frequently asked questions

Why does SES use an amazonses.com Return-Path?

SES can fall back to its default MAIL FROM domain when a configured custom MAIL FROM domain is unavailable or its configured fallback behavior permits it. Public DNS alone does not reveal the SES console setting.

Does a Return-Path mismatch prove SES fallback?

No. It is message-header evidence that the observed return path differs from the custom MAIL FROM domain entered for the check. Confirm the sending identity and SES configuration separately.

Related email diagnostics

Amazon SES MailFromDomainNotVerified: SES could not read the required MAIL FROM MX recordDiagnose Amazon SES MailFromDomainNotVerified safely. Check the exact custom MAIL FROM MX, SPF record, SES region and fallback behavior without changing the apex MX. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely.

Primary sources: Amazon SES custom MAIL FROM.