Our company owns the domain
somecompany.com and uses an external email provider
emailemailprovider.com to send emails. The email provider recommends to delegate a subdomain for them to automatically handle SPF / DKIM / etc. email authentication mechanisms. So we added this in our DNS zone:
em.somecompany.com NS ns1.emailemailprovider.com em.somecompany.com NS ns2.emailemailprovider.com
Since then, we are able to send emails through their API without falling in the SPAM folder of the recipients, and set the
From header to any address like
email@example.com. Note that the
Return-Path header domain is still
em.somecompany.com in all 3 cases.
I get how it's possible to authenticate
firstname.lastname@example.org with our setup, but I don't get why the 2 other FROM addresses are considered valid by the recipients.
I vaguely understand the difference between the
Return-Path header and the
From header, but if the company's subdomains were not owned and managed by the same entity, couldn't this lead to serious authentication flaws?