E-mails are not authentic enough. Should set envelope FROM.

If you ever checked your e-mail server logs or the actual SMTP transcript that happens as a result of Drupal's outgoing e-mails you will notice that it internally uses different account from sending other than what you provided in the From: header.

It differs from every e-mail server and every environment, especially the user which the PHP process is running under. But here is an example log entry for my GNU/Linux based system running Postfix mail server, as a result of executing this line:

drupal_mail('test', 'recipient@example.com', 'Testing From', 'Body goes here', 'sender@example.com');

The result in the logs:

Mar 15 02:15:31 localhost postfix/qmgr[5590]: 6CEAC3BB02: from=<www-data@example.com>, size=534, nrcpt=1 (queue active)

In the actual SMTP transcript, the sendmail utility used www-data as the real account it's using. So it issued something like: MAIL FROM: www-data@....

More importantly, if you check the complete message on the recipient, you will notice something like:

Return-Path: <www-data@...>

Of course, all the references to www-data are specific to my environment, but my vary depending on your setup. My point is, in most setup it's going to be something different than what was provided in the "From:" parameter which is probably unexpected.

The solution?
I could test successfully that specifying -f sender@example.com in the additional_parameters parameter for http://php.net/mail makes www-data go away and sender@example.com is used everywhere. But I've no idea of the portability of this on different platforms and setups.

References:

• http://php.net/function.mail
• http://www.php.net/manual/en/function.mail.php#72715