4.8.9. Invalid senders

Attention!

The problem can only occur when sending mail from a web server without authorization.

Blocking

Sender addresses are roughly divided into two types:

  • Invalid — addresses of mailboxes whose domains are not added in the control panel or are not related to hosting (for example, with domains of mail services gmail.com, ukr.net, third-party sites, etc.).
  • Valid — hosting account mail and the hosting account owner's corporate mail (not delegated).

Messages with incorrect senders are blocked. There is no point in sending such messages, as popular mail services do not accept them or treat them as spam in 99% of cases. Sending messages with valid senders is not affected by blocking.

When blocked, the error "5.7.1 Not authorized mail from web with invalid sender" occurs. Blocked messages will be visible in unsent emails log (only in the log for the hosting account, not for mail domain).

A notification is sent to the service owner once a day at 10:00 AM. with a list of detected invalid sender addresses for the last 24 hours and recommendations on how to fix the problem.

Common causes

  • Invalid address is specified in the CMS admin panel of your site.
  • Invalid address is specified directly in the site scripts and is substituted in the "From" field when sending a message.
  • There is a form on the site (like a feedback form) that accepts an email address, and then the site scripts try to send a message on behalf of that email.
  • Invalid address is generated dynamically by site scripts (e.g. for spamming).

Solution options

Using SMTP

Recommended method

Sending via SMTP with authorization is more reliable and secure than sending mail from a web server without authorization. From the point of view of mail services, such mail is more trustworthy (provided SPF, DKIM, DMARC are properly configured).

Needed:

  1. Make all messages sent from the site only via SMTP with authorization (the way of implementation depends on the site code or the CMS used).
  2. Configure SPF, DKIM, DMARC.

Selecting outgoing mail in site settings

Attention!

The method will not work if the sender address is substituted by a script.

If the sender is not substituted by the script, you can select an existing mailbox for outgoing mail in site settings (see Outgoing mail).

Changing the site's code

If the sender is substituted by a script, you need to find that script and modify it to substitute the mailbox of an existing mail domain. The mailbox itself doesn't have to exist. All that matters is that its address is within the existing mail domain.

Example of the console command for finding the sender address in PHP scripts: 

find . -type f -name '*.php' -exec grep -H "user@example.com" {} \;
Content
    (4)