Problem

RFC5382:

The return address in the MAIL command SHOULD, if possible, be
derived from the system's identity for the submitting (local)
user, and the "From:" header field otherwise. If there is a
system identity available, it SHOULD also be copied to the Sender
header field if it is different from the address in the From
header field. (Any Sender header field that was already there
SHOULD be removed.) Systems may provide a way for submitters to
override the envelope return address, but may want to restrict
its use to privileged users. This will not prevent mail forgery,
but may lessen its incidence; see Section 7.1.

This probably means when overriding the envelope sender in the module's settings it should also override the Sender: header.

Proposed Resolution

Look into it further and make any required changes.

Comments

imclean created an issue. See original summary.

imclean’s picture

imclean commented
Category: Task » Bug report

This is causing problems as the Sender header can contain a name and address whereas the envelope sender is just an address in angle brackets. PHPMailer uses the Sender property to set the envelope sender.

imclean’s picture

imclean commented

PHPMailer discussion here: https://github.com/PHPMailer/PHPMailer/issues/1250

imclean’s picture

imclean commented

It looks like Drupal may be setting the Sender header incorrectly. https://tools.ietf.org/html/rfc5322#section-3.6.2

  • imclean committed 63f4baf on 8.x-1.x 
    Issue #3099200: Envelope sender and Sender header
imclean’s picture

imclean commented
Status: Active » Fixed

Tidied up sender, envelope sender and from handling.

Changes:

  • Actually use the "From" header as the from address: $message['headers']['From']
  • Default envelope sender is the message "from" property: $message['from']
  • Correctly set the Sender header if present
  • Explicitly unset Return-Path header if present

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.