An email has several sender identities: the visible From address, the SMTP envelope sender, the DKIM signing domain, the connecting sending IP, and the domains used in links. They serve different purposes and can belong to different systems. To investigate delivery, write them down for a specific received copy instead of treating the familiar brand name in the From field as the identity of the entire sending route.
Read the visible author and the return route
The From header is the address normally presented as the message's author. Record its domain separately from the display name. A display name resembling your company does not authenticate the domain. Reply-To, when present, directs replies and is another useful field to inspect, but it does not replace the From domain for ordinary DMARC alignment.
The SMTP envelope sender is used during transport and is commonly reflected in Return-Path on the delivered copy. An ESP may use a bounce domain here. SPF evaluates the relevant SMTP identity and connecting IP; a successful SPF result for a provider-owned bounce domain does not automatically establish alignment with the visible From domain. Read the receiver's Authentication-Results rather than inferring a result from a DNS record alone.
Identify the signer and the connecting infrastructure
In DKIM-Signature, the d= value identifies the signing domain and s= identifies its selector. A message can contain multiple signatures. Determine which signature the receiver validated and whether a passing signing domain aligns with From for DMARC. A valid signature associates the signed content with a domain; it is not a certificate that the message is wanted by the recipient.
Record the public sending IP seen at the relevant receiving hop. Received headers contain a chain, so avoid choosing the first IP-shaped string without understanding the hop. A sender's workstation address, an ESP relay, and a forwarding gateway are different infrastructure. A domain lookup may show the website host rather than the server that actually delivered this email.
Treat link domains as separate objects
Extract the domains in visible links and actual link targets. A tracking service can replace a branded URL with a redirect domain. A link to a calendar, image host, or file service may introduce further domains. These are not authenticated by SPF merely because they appear inside a message from an authenticated sender.
Check that the final destinations are expected, functional, and consistent with the message's purpose. Preserve the real production links when testing. Removing all links creates a different message and cannot approve the linked version. A changed outcome after removing a link suggests a useful comparison; it does not prove that a particular domain is globally blocked.
Build an identity worksheet
For each representative route, save the From domain, envelope domain, passing DKIM domain, observed sending IP, and link domains with the test timestamp. Add the ESP account or stream and the template version. This worksheet explains why two systems using the same visible address can produce different authentication or placement outcomes.
Use the worksheet to assign ownership. DNS administrators may control signing records, the ESP may control a shared IP pool, and a marketing tool may rewrite URLs. Fix the component that the evidence identifies. Do not migrate the whole domain or purchase a dedicated IP because a problem belongs to one malformed tracking redirect.
Frequently asked questions
Are From and Return-Path supposed to match exactly?
They can differ legitimately. What matters for DMARC is the applicable authenticated domain's alignment with From under the selected alignment mode, not identical full mailbox addresses.
Is the DKIM selector another sending domain?
The selector locates a signing key within the signing domain's DNS namespace. Record it for diagnostics, but distinguish it from the d= domain and the visible author.
Which identity determines Inbox placement?
No single identity guarantees a folder. Authentication, infrastructure, content, recipient history, and other receiver signals can all matter. The worksheet prevents these objects from being confused.
Sources and scope
Source check: November 5, 2026. Source checking is separate from publication. Observations apply to the tested copies and conditions.