Skip to main content
VISO TRUST sends platform emails, such as assessment collection requests, through Postmark. If your mail gateway or security team needs to allowlist VISO TRUST emails, they typically ask for three values:
  • Envelope sender (SMTP MAIL FROM, also shown as the Return-Path header)
  • Sending hostname
  • IP addresses
The sending hostname and IP addresses are the same for every organization. The envelope sender depends on whether your organization uses the default Postmark return path or a custom return-path domain.
The envelope sender is not the same as the From address. The address you set under Custom email (for example, "Security Team" <security@yourdomain.com>) is the visible From header. The envelope sender is the bounce address mail servers use for SPF checks.

​
Check which configuration you use

Go to Settings → Org Profile → Manage domains and look at the RP Domain Verified column for the domain your custom email uses.

​
Default configuration

With the default configuration, VISO TRUST sends through Postmark’s shared infrastructure and uses Postmark’s return-path domain. SPF passes under Postmark’s domain, so you don’t need to add Postmark to your own SPF record.

​
Custom return-path configuration

With a custom return path, bounces go to a subdomain of your own domain. This aligns the envelope sender with your From domain for DMARC and improves deliverability. You enable it by adding a CNAME record for the return-path subdomain that points to pm.mtasv.net, then verifying it in VISO TRUST. See Configuring DKIM for the full steps. The Return Path Domain value in the Domain Verification Configuration dialog shows the exact subdomain to use, typically pm-bounces.yourdomain.com. For example, an organization that verified the return path for example.com has the envelope sender pm_bounces@pm-bounces.example.com.

​
IP addresses

Postmark sends VISO TRUST emails from the following outbound SMTP ranges: Postmark maintains the current list in IPs for firewalls. Check that page if your team allowlists by IP, since Postmark can change these ranges.

​
Confirm the envelope sender from a real email

To confirm the values for your organization, send a test email from VISO TRUST and inspect its headers. For example, add yourself as the recipient of an assessment collection request. In the raw message headers, look for:
  • Return-Path: <pm_bounces@...>. This is the envelope sender.
  • An envelope-from <pm_bounces@...> entry in the Received headers.
Share the address you find with your mail team as the envelope sender.