Create a key to copy examples filled with your team.
Return-path
We rewrite MAIL FROM to {id}@rp.your-domain.
Every sending domain gets rp.{name} as its return-path host. Point that CNAME at the PostShiba return-path zone. Verify requires this record, not only DKIM.
MAIL FROM rewrite
Kumo rewrites the envelope sender to {id}@rp.{domain} after it matches the From domain. id comes from the message id, with non-alphanumerics stripped. Empty id becomes bounce. The local part is capped at 64 characters.
return-path.json
1
{
2
"return_path_host": "rp.mail.example.com",
3
"return_path_target": "rp.postshiba.com"
4
}
DSN and ARF land on that host. PostShiba attributes bounces and spam reports from the return-path, then stores the event on the owning team.
You do not set Return-Path on the send API. That header is reserved and ignored. Kumo owns MAIL FROM.