By bkildow on

I'm trying to use the webform module (v6x-2.3) to create a sort of contact form. The issue I'm having is that I want the "from address" to be that of the value of a text field that the user inputs for their email address. This way when I receive the email it appears like it is from the user that submitted it, and I can click reply to send a message to them. I see there is area under editing the webform where you can use a drop down box to specify a "from address" based on the elements of my form, however it appears only to pick up the elements that are drop-down boxes and not text input types.

Does anyone have any idea how to get the "from address" to be based on the value of a text input element?

⋅ Categories: Drupal 6.x

Comments

bkildow’s picture

bkildow commented

I just had to change the textfield to type "email" and I could then select it from the drop-down.

justageek’s picture

justageek commented

Be careful using a 'from' address field in your form to send email, unless the webform module automatically filters it for a valid address. It is fairly easy to use a 'from' address text field to send malicious email / spam by putting in email headers in the text box.

anishvinoj’s picture

anishvinoj commented

You might have used textfield instead of "email" while assigning fields in "form components" change the field as "email" for your e-mail address, and in Configuration under Webform Mail Settings under Email From Address choose components and in the drop down menu you can see your email label , kindly select that

It will work

Have a Nice Day!

Regards,
Anish

scottprive’s picture

scottprive commented

Not necessarily a WebForm issue, but beware: You can cause these emails to be "lost" (spam filtered) if you put user-defined "From:" address in as the webform email's from.

Quick background:
From: addresses , as you know, are routinely forged by spammers. This causes all sorts of problems, including phishing or simply tarnishing the reputation of the domain which was spoofed in the From: address.

Any mail sent directly off the drupal host will of course appear as originating from that IP. Well, let's say your email has a From of "billgates@microsoft.com". Well, you are saying actually that you are sending email on behalf of Microsoft.com. Is it a forgery, or not?

Other mailsites will look at the originating email IP (your drupal IP), and then consult DNS SPF/TXT records for the alleged sender. The SPF/TXT will list server addresses that the sender domain permits to send mail. On gmail, the email lands in the Spam lands in the SPAM folder (and if you "Show Original" on the email, the full headers will show Gmail saw an SPF record failure... this is good to know for troubleshooting why your mail went int Spam, by the way..)

Since your Drupal server IP is NOT going to be listed in the from domain's DNS SPF record, the SPF test fails, and the mail is flagged as a forgery. Maybe your message gets blackholed, or put into the spam filter. (What happens exactly is policy for the site the mail gets sent TO).

Suggestions:
Do not send email out directly from your Drupal server. This goes for many reasons, not just the SPF issue. Spam filters do not like email which comes from a webserver. Instead, install and configure the SMTP Authentication module. Assuming your website (or company) has a REAL email server (or email hosting, somewhere) you want to SMTP relay your mail through that server.

Back to the main point, do not set user-defined From. Use something like notifications@yourdomain.com, and in the BODY of the message you might state that "billgates@microsoft.com thought you might be interested in this content". OK, that is silly and could be written better. But the point is, you identified who is sending this, without tainting the From address with something that could get caught in a spam filter.

Offtopic, but if you send email "from" an address (say notifications@yourdomain.com), be sure that address EXISTS on your email server. If you were using noreply@yourdomain.com and you really do not want replies, just blackhole (delete) the email automatically. Otherwise some sites will refuse the mail, because they will actually try checking your domain's MX record and see if that mailbox (noreply) exists.

If you want to know more about the SPF/From issue, look up OpenSPF documentation at http://www.openspf.org/