> ## Documentation Index
> Fetch the complete documentation index at: https://docs.visotrust.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Email Sending and Allowlisting

> Find the envelope sender, sending hostname, and IP addresses your mail team needs to allowlist VISO TRUST emails, for both default and custom return-path setups.

VISO TRUST sends platform emails, such as assessment collection requests, through [Postmark](https://postmarkapp.com). If your mail gateway or security team needs to allowlist VISO TRUST emails, they typically ask for three values:

* **Envelope sender** (SMTP `MAIL FROM`, also shown as the `Return-Path` header)
* **Sending hostname**
* **IP addresses**

The sending hostname and IP addresses are the same for every organization. The envelope sender depends on whether your organization uses the default Postmark return path or a custom return-path domain.

<Note>
  The envelope sender is not the same as the **From** address. The address you set under **Custom email** (for example, `"Security Team" <security@yourdomain.com>`) is the visible **From** header. The envelope sender is the bounce address mail servers use for SPF checks.
</Note>

## Check which configuration you use

Go to **Settings → Org Profile → Manage domains** and look at the **RP Domain Verified** column for the domain your custom email uses.

| RP Domain Verified | Configuration | Envelope sender |
| - | - | - |
| **No**, or no custom email set | [Default](#default-configuration) | `pm_bounces@pm.mtasv.net` |
| **Yes** | [Custom return path](#custom-return-path-configuration) | `pm_bounces@pm-bounces.yourdomain.com` |

## Default configuration

With the default configuration, VISO TRUST sends through Postmark's shared infrastructure and uses Postmark's return-path domain.

| Value | Setting |
| - | - |
| Envelope sender domain | `pm.mtasv.net` |
| Envelope sender (Return-Path) | `pm_bounces@pm.mtasv.net` |
| Sending hostname | `mtasv.net` |

SPF passes under Postmark's domain, so you don't need to add Postmark to your own SPF record.

## Custom return-path configuration

With a custom return path, bounces go to a subdomain of your own domain. This aligns the envelope sender with your **From** domain for DMARC and improves deliverability.

You enable it by adding a CNAME record for the return-path subdomain that points to `pm.mtasv.net`, then verifying it in VISO TRUST. See [Configuring DKIM](/organization-settings/organization-profile#configuring-dkim) for the full steps. The **Return Path Domain** value in the **Domain Verification Configuration** dialog shows the exact subdomain to use, typically `pm-bounces.yourdomain.com`.

| Value | Setting |
| - | - |
| Return-path CNAME | `pm-bounces.yourdomain.com` → `pm.mtasv.net` |
| Envelope sender domain | `pm-bounces.yourdomain.com` |
| Envelope sender (Return-Path) | `pm_bounces@pm-bounces.yourdomain.com` |
| Sending hostname | `mtasv.net` |

For example, an organization that verified the return path for `example.com` has the envelope sender `pm_bounces@pm-bounces.example.com`.

## IP addresses

Postmark sends VISO TRUST emails from the following outbound SMTP ranges:

| Range | Addresses | Message stream |
| - | - | - |
| `50.31.156.96/27` | 50.31.156.96 – 50.31.156.127 | Transactional |
| `104.245.209.192/26` | 104.245.209.192 – 104.245.209.255 | Transactional |
| `50.31.205.204/30` | 50.31.205.204 – 50.31.205.207 | Transactional |
| `50.31.205.0/24` | 50.31.205.1 – 50.31.205.255 | Broadcast |

Postmark maintains the current list in [IPs for firewalls](https://postmarkapp.com/support/article/800-ips-for-firewalls). Check that page if your team allowlists by IP, since Postmark can change these ranges.

## Confirm the envelope sender from a real email

To confirm the values for your organization, send a test email from VISO TRUST and inspect its headers. For example, add yourself as the recipient of an assessment collection request.

In the raw message headers, look for:

* `Return-Path: <pm_bounces@...>`. This is the envelope sender.
* An `envelope-from <pm_bounces@...>` entry in the `Received` headers.

Share the address you find with your mail team as the envelope sender.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.