VERP: knowing which message bounced

A bounce is not a response to your delivery attempt. It is a separate message, delivered later, by a server that may tell you very little about what it is bouncing.

If every message you send carries the same return-path, every bounce arrives at the same mailbox with no reliable indication of which send produced it. You are left parsing the body, which is unstructured text that varies by provider.

What VERP does

Variable Envelope Return Path encodes the recipient into the return-path itself:

bounce+user=example.com@send.yourdomain.com

The bounce comes back to that exact address. You do not need to parse anything — the address you received it at identifies the recipient unambiguously.

It is the envelope sender, not the From header, so the recipient never sees it.

Why the obvious alternatives are worse

Parsing the bounce body means handling every provider's format, and the formats change. A message that quotes the original headers is parseable; one that says "delivery failed" and nothing else is not.

Matching on Message-ID works when the bounce includes the original headers and fails when it does not. Plenty of bounces do not.

A per-send return-path tells you which campaign bounced but not which recipient, which is not enough to suppress anything.

Implementation

Encode the recipient, and sign or hash it. An unauthenticated VERP address is an oracle: anyone can enumerate addresses by sending to variations of it and watching what happens. A short HMAC in the local part prevents that.

Keep it under the length limit. The local part is capped at 64 characters by specification, and some servers are stricter. An encoded address plus a signature plus a prefix adds up quickly — a truncated hash is usually the right trade.

Route the whole subdomain to one handler with a catch-all, and publish SPF and DKIM for it. A return-path domain that fails SPF makes bounce handling worse, not better.

What to do with what comes back

Having attributed the bounce, classify it before acting. A permanent failure — no such mailbox, domain does not exist — means suppress immediately. A temporary one — over quota, greylisted, rate-limited — means retry, and suppressing on it loses you a valid recipient.

The classification guide covers reading the codes. The important half of the pairing is this: VERP tells you who, classification tells you what to do, and you need both.

One caution

VERP means every message has a unique envelope sender. Some naive filters treat a high diversity of return-paths from one IP as a signal in itself. In practice this is rare and well outweighed by the benefit, but it is worth knowing if you see unexplained filtering immediately after enabling it.