If your email runs on Duobox and you wondered what the two Bounces rows in the DNS table are, this is for you. Also if you ever saw “via amazonses.com” under one of your messages.
An email has two senders. The one people see —the From:, you@yourcompany.com— and the envelope one, SMTP's MAIL FROM, which is where a bounce goes back if the address doesn't exist. That second one is written into the message as Return-Path.
Mail leaving Duobox is delivered by Amazon SES. Until now the envelope belonged to SES, and Gmail showed it as is: “via amazonses.com” under your name.
Why it mattered
SPF doesn't check the From:: it checks the envelope domain. It passed, but for amazonses.com, which isn't yours. DMARC doesn't count that, because DMARC asks for SPF or DKIM to pass for a domain aligned with the `From:`.
So every domain's DMARC stood on one leg, the DKIM signature. If something along the way broke the signature —a mailing list adding a footer, an antivirus rewriting a link— nothing was left holding it up.
What we did
Every domain now has a bounce.yourdomain.com subdomain that acts as the envelope, with two records:
| Type | Name | Value |
|---|---|---|
| MX | bounce | 10 feedback-smtp.us-east-1.amazonses.com |
| TXT | bounce | v=spf1 include:amazonses.com ~all |
The MX is where SES receives bounces; the TXT authorizes it to send on behalf of that subdomain. We ask SES to use bounce.yourdomain.com as your domain's MAIL FROM, and from then on the Return-Path is yours, SPF passes and aligns —bounce.yourdomain.com and yourdomain.com are the same domain to DMARC— and DMARC stands on two legs instead of one.
What you need to do
If we run your domain's DNS, nothing: the records are already there, and older domains got them on their next verification.
If you connected a domain you keep with another provider, you'll see two new rows, Bounces, in the DNS table. Copy them over there.
And if you don't, your mail still goes out. That was on purpose: while the bounce MX is missing, SES falls back to the old envelope. Making them mandatory would have stopped companies whose mail already worked from sending. We'd rather have an upgrade you gain than a requirement that cuts you off.
To check they took, open your domain's DNS tab in the hub: the two Bounces rows say whether they are verified. More changes like this one, in the changelog.