Why Email is Marked “Via [Service]” or “On Behalf Of”

When recipients view an email in Gmail, they may notice a secondary domain tag next to the sender’s name, such as support@company.com via mailgun.org or newsletter@company.com via sendgrid.net. In Microsoft Outlook, this same condition displays as mailgun.org on behalf of support@company.com. This visual warning indicates that the visible sender address displayed in the email client does not match the actual mail server that transmitted the message, and the sending server lacked an aligned cryptographic signature tied to your domain.

Quick Answer

Email clients display “via [service]” or “on behalf of” when the human-readable “From” address does not match the technical Return-Path (envelope sender) domain. To remove this disclaimer, configure a custom DKIM signature and a custom Return-Path domain inside your third-party email provider (such as Mailchimp, SendGrid, or Zendesk).

---

The Technical Mechanism: Header From vs. Envelope From

Every email contains two distinct sender addresses defined by internet messaging standards:

1. The Header From (RFC 5322): The display address visible in the user interface (e.g., From: sales@yourcompany.com). This is the address users see and reply to.
2. The Envelope From / Return-Path (RFC 5321): The technical routing address used by mail servers to handle bounces, delivery receipts, and SPF checks (e.g., bounces@sendgrid.net or marketing@mcsv.net).

When a company hires a third-party platform (such as HubSpot, Salesforce, or Zendesk) to send emails, the third-party service transmits the message using its own servers and default Return-Path.

Because anyone can write any address in the “Header From” field, modern email clients treat mismatches between the Header From and the Return-Path as potential spoofing attempts. To inform the user, Gmail prints “via [provider]” and Outlook displays “on behalf of [provider]”.

---

How to Remove the “Via” Tag

To make third-party emails look authentic and eliminate the “via” disclaimer, you must establish cryptographic domain alignment. This requires configuring custom DNS records that allow the third-party service to sign emails directly with your domain’s identity.

+-----------------------------------------------------------------------------------+
| BEFORE ALIGNMENT (Triggers "via service.com")                                     |
| Display From: user@yourdomain.com                                                 |
| Return-Path:  bounces@thirdpartyservice.com                                       |
| DKIM Domain:  d=thirdpartyservice.com                                             |
+-----------------------------------------------------------------------------------+
                                         │
                                         ▼ (Add DNS CNAME Records)
+-----------------------------------------------------------------------------------+
| AFTER ALIGNMENT ("via" label disappears)                                          |
| Display From: user@yourdomain.com                                                 |
| Return-Path:  bounces@em.yourdomain.com  (Points to third-party host)             |
| DKIM Domain:  d=yourdomain.com           (Signs on behalf of your brand)          |
+-----------------------------------------------------------------------------------+

---

Step 1: Configure Custom DKIM Signing in Your Provider

DKIM (DomainKeys Identified Mail) attaches a digital signature to the message header. When Gmail detects a valid DKIM signature where the signing domain (d=yourdomain.com) matches the domain in the “From:” line, it automatically strips the “via” tag, even if the Return-Path points elsewhere.

1. Log into your third-party email provider (e.g., Mailgun, Klaviyo, Amazon SES).
2. Locate the Domain Authentication or Sender Authentication settings.
3. Choose the option to authenticate your domain using DKIM.
4. The provider will supply two or three CNAME records (or a TXT record) containing public cryptographic keys.
5. Log in to your DNS management console (Cloudflare, GoDaddy, AWS Route 53, etc.).
6. Publish these records under your domain.
7. Return to the email provider dashboard and click Verify.

Once verified, the service signs every outgoing message with your domain key. For a detailed guide on matching signatures across tools, see How to Align SPF/DKIM for Third-Party Apps.

---

Step 2: Establish a Custom Return-Path (Envelope Sender)

While DKIM alone removes the “via” tag in Gmail, Microsoft Outlook often requires the Return-Path to align with the From domain to remove the “on behalf of” text.

1. In your third-party sending platform, look for the Custom Return-Path or Custom Mail-From Domain setting.
2. The platform will ask you to specify a subdomain (common choices include mail.yourdomain.com, bounces.yourdomain.com, or em.yourdomain.com).
3. Add the required CNAME or MX/TXT record in your DNS provider pointing that subdomain back to the provider’s server.
4. When email is sent, the technical envelope address becomes bounce@mail.yourdomain.com.

Because both the display address and the envelope address now share the root domain (yourdomain.com), Outlook recognizes full organizational ownership and removes the “on behalf of” disclaimer.

---

Step 3: Verify the Alignment in Gmail Headers

After updating your DNS records and verifying them in your provider dashboard:

1. Send a test email from the third-party service to a personal Gmail address.
2. Open the message in Gmail.
3. Next to the sender’s name, check if the “via” tag has disappeared.
4. Click the three vertical dots on the right side of the email and select Show original.
5. Inspect the summary table at the top:
   • SPF: Must report PASS with your root or subdomain.
   • DKIM: Must report PASS with your domain (d=yourcompany.com).
   • DMARC: Must report PASS.

• SPF: Must report PASS with your root or subdomain.
• DKIM: Must report PASS with your domain (d=yourcompany.com).
• DMARC: Must report PASS.

If DKIM shows a pass but reports the wrong domain name, check Resolving “Message not authenticated by DKIM”. To master reading raw routing logs, review How to Read Gmail “Original Message” Headers.