Amazon SES custom MAIL FROM

Check an SES MAIL FROM fallback or Return-Path mismatch

A custom SES MAIL FROM domain should be visible in a newly sent message’s Return-Path. Compare that header identity with the explicitly configured custom subdomain, then inspect MX and SPF at that exact DNS name.

Problem description

A sent message appears to use a different Return-Path than the configured SES custom MAIL FROM domain:

Return-Path does not match the configured SES custom MAIL FROM domain.

Compare SES MAIL FROM free

Required evidence: paste only the complete message headers and enter the custom MAIL FROM subdomain configured in SES. MailFixIt extracts a normalized Return-Path domain; it does not return raw headers.

What the diagnostic reports

Observed identity: whether the supplied message’s Return-Path domain matches the configured custom MAIL FROM domain.
Current DNS: MX and SPF state at the configured custom MAIL FROM subdomain, separate from apex inbound mail records.
Bounded conclusion: a mismatch is message-header context, not proof of the SES fallback setting or of a sender-side fault.

Safe investigation sequence

Confirm that the message was sent through the SES identity and Region that owns the custom MAIL FROM setting.
Compare the observed Return-Path and configured custom MAIL FROM domain exactly.
Verify the SES-issued MX target and SPF publication at the custom subdomain.
Review the selected SES behavior for MAIL FROM MX failure in the console.
Send a fresh message after any verified correction and inspect new headers.

DNS results do not prove SES has refreshed its verification state, and a matching Return-Path does not independently verify SPF/DKIM alignment. Official reference: Amazon SES custom MAIL FROM domains.