Not all email headers allow tokens

Can you explain why that would be better? Wouldn't that get in the way of using a custom mailhandlers? (I for example use my own HTML mailhander, not webforms)

Anyway I've had to revisit my code above since it wasn't working properly. Attached is a functional patch now.

I removed some todo's and logic because it shouldn't be webforms responsibility to check for correct things to avoid SPAM. That should be the responsibility of the site builder. We could indicate in the config screens of webform and the submissions mail handler what to do and not to do.

Basically, to make sure messages are never marked as SPAM:
1/ The "to", "from" and "reply-to" can be anything you want it to be
2/ The "return-path" should always be internal and a verifiable address
3/ The "sender" should be an internal and a verifiable address, but it can be omitted if the "from" is an internal and a verifiable address

I think I understand now :) I'll have another crack at it soon.

I figured out why the tokens weren't working, in fact some parameters were just never set.

This line of code prevented "sender, return_path" from ever being set because they are not configurable within an email handler and can never have the value "default": (EmailWebformHandler::getMessage())

// Set default value.
if ($configuration_value === 'default') {
  $configuration_value = $this->getDefaultConfigurationValue($configuration_key);
}

So I changed to:

// Set default value.
if ($configuration_value === 'default' || empty($configuration_value)) {
  $configuration_value = $this->getDefaultConfigurationValue($configuration_key);
}

And things started working properly.

I've attached a patch with this fix included.
Fixed a few other minor issues with the headers and from/to-thingies in the mailhandler.
I've gotten rid of most of the logic in the hook_mail. (it's indeed better to do as little as possible there)
I've also updated the default settings for return_path and sender_mail/name, because those are vital at preventing spam detection if you start using submission tokens in the from address.

I have not added tests yet. Could you confirm I'm on the right path here?

I've removed any other changes and just kept the changes to make token replacements in the headers work. (still need to add tests)

Still an issue left with the From header that wasn't correctly set with the previous patch.

Not sure why it was failing... let's try again.

OK, I was patching against RC1, not dev. That was the problem... Attached is the patch against RC1, I will make one against latest dev as well.

And the patch against dev.

(ignore this comment, didn't see you created a new patch :))