Return-Path aligned with From domain

SPF authenticates the envelope sender (Return-Path), not the visible From header. When an ESP handles bounces from a different domain than your From address — e.g., From is noreply@company.com but Return-Path is bounce@esp-platform.net — SPF passes for the ESP's domain but fails alignment with your From domain. Under strict DMARC (adkim=s; aspf=s), misaligned SPF causes DMARC to fail even when SPF itself passes, per RFC7489-s3.1. The practical result is that emails landing in Gmail and Outlook are more likely to be filtered, defeating the purpose of your authentication stack.

Configure a custom bounce subdomain that you own and authenticate independently. In SendGrid, complete Domain Authentication which sets the Return-Path to bounces@em.company.com. In nodemailer, set the envelope sender explicitly:

const mailOptions = {
  from: '"Company" <noreply@company.com>',
  envelope: {
    from: 'bounces@mail.company.com', // subdomain of company.com — aligned
    to: recipient
  },
  subject: 'Your message'
}

Then publish SPF for mail.company.com to authorize the bounce-handling infrastructure. Verify alignment programmatically by checking that the envelope sender domain shares a registered domain with the From header domain.