4.8.10. Invalid "From" header

The problem arises because the message is sent from one mailbox, but when the message body is generated, the "From" header contains the address of a mailbox from a different mail domain that is in no way associated with the domain from which the message is actually being sent. For example, an email is sent from the mailbox mail@example.com, but the "From" header contains an address such as johndoe@gmail.com, which is unrelated to mail@example.com. Such messages will not be delivered.

The address that appears in the header can be specified in the site's code or database, or a script can retrieve it via a form on the site. There is no one-size-fits-all answer to this question; it all depends on the site's code, the CMS used, plugins, and so on.

In addition, this problem may occur when using a redirect in a third-party mail client. In this case, the sender's actual address and the address in the "From" header will differ, and the messages will not be delivered.

When sent from a web server without authorization, the header is considered valid under the following conditions:

• The mail domain from the header added in your account.
• The sender's hosting account and the mail domain in the header belong to the same account.
  • If the account belongs to only one of the services and the other is delegated, the header is not considered valid.
• If a sender is specified (either outgoing mail is selected or the -f parameter is used in the PHP mail function), the mail domain in the header must match the sender's domain.
• If no sender is specified, the header must contain the address of your mail domain.
• If neither the sender nor the subject is specified, the header will contain the default mail address in the *.default-host.net format.
  • Our service allows you to send such emails, but delivery is not guaranteed, as recipients may reject them.

When sending via SMTP with authentication, the header is considered valid under the following conditions:

• The mail domain has been added to the account and the mailbox has been created (you cannot send emails without these).
• The mail domain in the header matches the domain of the mailbox from which the message is being sent.

The header is not checked if the mail domains of all recipients belong to the same account as the sender's mail domain (non-delegated).

When sending from a web server without authorization:

• The header is set by the site's scripts (this method takes precedence over the settings in the hosting control panel).
• If the message is sent via the site and the header is not specified in the scripts, the outgoing mail from the site settings is used.
• In all other cases, the default outgoing mail address from the hosting account settings is used.

When sending via SMTP with authentication:

• The header is set by the sending script or the mail client being used.

Before sending each email, the system checks the validity of the "From" header. If the header is invalid, the following occurs:

1. Sending the email is blocked.
2. A record of the sending attempt is added to the unsent emails log.
3. The attempt to send the email is included in the statistics for the current day.
4. Early the next day, an message with statistics for the previous day is sent to your email.

Only specific messages with incorrect headers are blocked. Messages with a valid "From" header are not affected in any way — they are sent as usual.

These are sent to your email early the next day and contain statistics on messages with an incorrect "From" header from the previous day.

You can manage notifications in the notification settings using the "Service restrictions" option.

A list of logs that can help identify the source of messages with incorrect headers.

When sending from a web server without authorization:

• All attempts to send messages are visible in the site mail log.
• Attempts to send messages via sites are visible in the PHP mail logs (individually for each site).
• All attempts to send messages with invalid headers are visible in the unsent emails log for hosting account.
• Errors related to the PHP mail function when sending messages via sites are visible in the PHP error logs (individually for each site).

When sending via SMTP with authentication:

• All connections made during send attempts are visible in the mailbox connection logs (individually for each mailbox).
• All attempts to send messages with invalid headers are visible in the unsent emails log for mail domain (individually for each mail domain).

If the emails are sent from the site, you can compare the send times with the request times in the site access logs. For example, if a POST request was made to the site’s scripts at the same time an email with an incorrect header was attempted to be sent, it is highly likely that these scripts are related to that email (often these are various contact forms, order forms, etc.).

If the problem is related to the site, the solution usually comes down to the following:

1. Find the script or plugin on the site that handles sending messages.
2. Determine what information it substitutes in the "From" header and where it gets it from.
3. Ensure that the correct sender is substituted into the script.

In other words, if the script sends a message on behalf of the mail@example.com email address, then the "From" header must also specify that same email address.

You can take action depending on the addresses you see in notifications about emails sent with an incorrect "From" header:

• The "From" header contains one of your domains:
  • Check whether the corresponding mail domain is added in your account.
  • Make sure the mail domain belongs to the same account as the hosting account from which the message is being sent (delegation does not apply)
• The "From" header contains your mailbox address on a third-party mail service:
  • Check the mailing scripts on your site or the settings of your CMS, find this address, and replace it with the mailbox address of one of your mail domains.
  • If you want to continue sending messages from the mailbox of a third-party mail service, configure sending via SMTP.
• The "From" header contains various addresses that you don't recognize:
  • Check the form handlers on your site or the settings of your CMS, find the place where an incorrect address is being inserted into the header, and make sure that the address of a mailbox on one of your mail domains is inserted instead.

If the problem is related to a redirect in a third-party mail client, follow these steps to resolve it:

1. Disable redirects in third-party mail client.
2. Organize the delivery of messages to the desired mailbox using one of the following methods:
   • Set up a redirect in the control panel.
   • Set up a redirect using filters in WebMail.Online or WebMail classic.