diff --git a/modules/rinbox/agent-notify.ts b/modules/rinbox/agent-notify.ts
index 97c2b990..71120b99 100644
--- a/modules/rinbox/agent-notify.ts
+++ b/modules/rinbox/agent-notify.ts
@@ -75,8 +75,9 @@ export async function sendSpaceNotification(
 		// Filter out excluded DIDs' emails if needed
 		const recipients = options?.excludeDids ? emails : emails;
 
-		const fromAddr = `MI Agent <${space}-agent@rspace.online>`;
-		const replyTo = options?.replyTo || `${space}-agent@rspace.online`;
+		const agentAddr = `${space}-agent@rspace.online`;
+		const fromAddr = `MI Agent <${agentAddr}>`;
+		const replyTo = options?.replyTo || agentAddr;
 
 		await transport.sendMail({
 			from: fromAddr,
@@ -84,6 +85,7 @@ export async function sendSpaceNotification(
 			subject,
 			html: htmlBody,
 			replyTo,
+			envelope: { from: agentAddr, to: recipients },
 		});
 
 		console.log(`[AgentNotify] Sent "${subject}" to ${recipients.length} members of ${space}`);
diff --git a/modules/rinbox/mod.ts b/modules/rinbox/mod.ts
index b850a866..1ac22872 100644
--- a/modules/rinbox/mod.ts
+++ b/modules/rinbox/mod.ts
@@ -460,8 +460,8 @@ async function executeApproval(docId: string, approvalId: string) {
 			replyTo: agentReplyTo,
 			subject: approval.subject,
 			text: approval.bodyText,
-			// Envelope override: authenticate as SMTP_USER but show mailboxEmail in From header
-			envelope: { from: SMTP_USER || 'noreply@rmail.online', to: approval.toAddresses },
+			// Envelope aligned with From header so rspamd DKIM-signs with the mailbox's domain (DMARC alignment)
+			envelope: { from: mailboxEmail, to: approval.toAddresses },
 		};
 
 		if (approval.ccAddresses.length > 0) {
diff --git a/server/notification-service.ts b/server/notification-service.ts
index b9fcc2b6..5d043b7e 100644
--- a/server/notification-service.ts
+++ b/server/notification-service.ts
@@ -282,13 +282,15 @@ async function sendEmailNotification(stored: StoredNotification, opts: NotifyOpt
       </p>
     </div>`;
 
+  const agentAddr = `${space}-agent@rspace.online`;
   try {
     await transport.sendMail({
       from: fromAddr,
       to: userEmail,
       subject: stored.title,
       html,
-      replyTo: `${space}-agent@rspace.online`,
+      replyTo: agentAddr,
+      envelope: { from: agentAddr, to: userEmail },
     });
     await markNotificationDelivered(stored.id, 'email');
     console.log(`[email] Sent "${stored.title}" to ${opts.userDid}`);
diff --git a/server/spaces.ts b/server/spaces.ts
index a1dbc8be..b122c2d4 100644
--- a/server/spaces.ts
+++ b/server/spaces.ts
@@ -2228,7 +2228,7 @@ spaces.post("/:slug/invite", async (c) => {
 					await inviteTransport.sendMail({
 						from: `${slug} <${agentAddr}>`,
 						replyTo: agentAddr,
-						envelope: { from: process.env.SMTP_USER || "noreply@rmail.online", to: body.email },
+						envelope: { from: agentAddr, to: body.email },
 						to: body.email,
 						subject: `${inviterName} invited you to "${slug}" on rSpace`,
 						html: `
@@ -2358,7 +2358,7 @@ spaces.post("/:slug/members/add", async (c) => {
 			await inviteTransport.sendMail({
 				from: `${slug} <${agentAddr}>`,
 				replyTo: agentAddr,
-				envelope: { from: process.env.SMTP_USER || "noreply@rmail.online", to: targetEmail },
+				envelope: { from: agentAddr, to: targetEmail },
 				to: targetEmail,
 				subject: `${inviterName} invited you to "${slug}" on rSpace`,
 				html: `
diff --git a/src/encryptid/server.ts b/src/encryptid/server.ts
index 5d45e6e8..904408ae 100644
--- a/src/encryptid/server.ts
+++ b/src/encryptid/server.ts
@@ -5922,7 +5922,7 @@ app.post('/api/invites/identity', async (c) => {
       await smtpTransport.sendMail({
         from: agentAddr ? `${spaceSlug} <${agentAddr}>` : CONFIG.smtp.from,
         ...(agentAddr ? { replyTo: agentAddr } : {}),
-        ...(agentAddr ? { envelope: { from: CONFIG.smtp.user, to: email } } : {}),
+        ...(agentAddr ? { envelope: { from: agentAddr, to: email } } : {}),
         to: email,
         subject: subjectLine,
         html: `