[wp-trac] [WordPress Trac] #49687: wp_mail() - Why is no envelope sender defined?

[WordPress Trac]

#49687: wp_mail() - Why is no envelope sender defined?
-----------------------------+------------------------------
 Reporter:  vbbp             |       Owner:  (none)
     Type:  enhancement      |      Status:  new
 Priority:  normal           |   Milestone:  Awaiting Review
Component:  Mail             |     Version:  5.4
 Severity:  major            |  Resolution:
 Keywords:  needs-test-info  |     Focuses:
-----------------------------+------------------------------

Comment (by knutsp):

 Replying to [comment:14 SirLouen]:

 > I've been testing, and as I said in my previous message, the absence of
 `Sender` should not be an inconvenience in 2025 for any reliable local
 MTA.

 Last time I tested it from one specific host (webhuset.no), they are using
 spamexperts, was in 2024. Messages to [redacted]@gmail.com did not get
 through at all, not even in the spam box. On some other web hosts (5 on
 different frameworks) it came through, but was usually marked spam. So I
 added:
 {{{#!php
 \add_action( 'phpmailer_init', static function(
 \PHPMailer\PHPMailer\PHPMailer $phpmailer ): void {
         $phpmailer->Sender = $phpmailer->From;
 } );
 }}}
 and it immediately worked as expected.

 Now, in 2025, the message gets through from the first host, too. But:

 Without the above filter:

 {{{
 Authentication-Results: mx.google.com;
        spf=pass (google.com: domain of anonymous at qmqp.datacenter.no
 designates [REDACTED_IP] as permitted sender)
 smtp.mailfrom=anonymous at qmqp.datacenter.no;
        dmarc=fail (p=QUARANTINE sp=NONE dis=QUARANTINE)
 header.from=[REDACTED HOST]
 Received: from [[REDACTED_IP]] (helo=qmqp.hmg9.webhuset.no) by
 02.spamexperts.u87.webhuset.no with esmtps
   (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from
 <anonymous at qmqp.datacenter.no>) id 1ujm0n-00DXJ1-Q7 for
 [redacted]@gmail.com; Wed, 06 Aug 2025 23:49:31 +0200
 Received: (qmail 541408 invoked by uid 0); 6 Aug 2025 21:49:29 -0000
 Received: from unknown ([REDACTED_IP])
   by 0 with QMQP; 6 Aug 2025 21:49:29 -0000
 To: [redacted]@gmail.com
 }}}

 With above filter active:

 {{{
 Authentication-Results: mx.google.com;
        spf=pass (google.com: domain of wordpress@[REDACTED HOST]
 designates [REDACTED_IP] as permitted sender)
 smtp.mailfrom=wordpress@[REDACTED HOST];
        dmarc=pass (p=QUARANTINE sp=NONE dis=NONE)
 header.from=[REDACTED_HOST]
 Received: from [[REDACTED_IP]] (helo=qmqp.hmg9.webhuset.no) by
 01.spamexperts.u87.webhuset.no with esmtps
   (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from
 <wordpress@[REDACTED_HOST]>) id 1ujlw6-002IwQ-Id for [redacted]@gmail.com;
 Wed, 06 Aug 2025 23:44:39 +0200
 Received: (qmail 541054 invoked by uid 0); 6 Aug 2025 21:44:38 -0000
 Received: from unknown ([REDACTED_IP])
   by 0 with QMQP; 6 Aug 2025 21:44:38 -0000
 To: [redacted]@gmail.com
 }}}

 Conclusion:
 1. The Sender seems to decide what/how DMARC is checked.
 2. The safest way to ensure correct delivery is still to include Sender,
 even in 2025.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/49687#comment:15>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform