wp_mail(): Set sender address by default.

dmsnell · dmsnell · commit 1885bee23c78 · 2025-10-21T08:04:22.000Z
WordPress has been calling `$phpmailer->setFrom()` with a `false` value for an attribute telling it to set the sender address for each message. This sender address is also known by other names: Envelope-From, MAIL FROM, Return-Path, etc... Unfortunately, this configuration can easily lead to mail being rejected by numerous mail hosts due to an invalid domain being generated by the local mail server/MTA. The flag was originally added with the note that its absence “causes outgoing email to fail on some server environments.” However, it is likely that this led to the opposite effect, as evidenced by numerous reports, plugins, and workarounds over the years. In this patch the flag is being removed, which has the effect of letting `$phpmailer` set the Sender value, which it does by default using the domain “where the front end is accessible” and which is is likely correct. After this change there is a chance of mail failure for sites with SPF configured but which does not allow mail to be sent on behalf of this domain and if those sites also do not have a properly configured DKIM and DMARC setup. Those sites should review their SPF policies or the `wp_mail_from` filter. Developed in #9412 Discussed in https://core.trac.wordpress.org/ticket/49687 Follow-up to [38286]. Props cbutlerjr, dmsnell, jamieburchell, knutsp, kub1x, lordandy1984, piskvorky, SergeyBiryukov, siliconforks, SirLouen, stankea, vbbp, websupporter. Fixes #49687. git-svn-id: https://develop.svn.wordpress.org/trunk@61010 602fd350-edb4-49c9-b593-d223f7449a82
diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php
@@ -432,7 +432,7 @@ function wp_mail( $to, $subject, $message, $headers = '', $attachments = array()
 		$from_name = apply_filters( 'wp_mail_from_name', $from_name );
 
 		try {
-			$phpmailer->setFrom( $from_email, $from_name, false );
+			$phpmailer->setFrom( $from_email, $from_name );
 		} catch ( PHPMailer\PHPMailer\Exception $e ) {
 			$mail_error_data                             = compact( 'to', 'subject', 'message', 'headers', 'attachments' );
 			$mail_error_data['phpmailer_exception_code'] = $e->getCode();
diff --git a/tests/phpunit/tests/pluggable/wpMail.php b/tests/phpunit/tests/pluggable/wpMail.php
@@ -408,21 +408,18 @@ public function test_wp_mail_addresses_arent_encoded() {
 	}
 
 	/**
-	 * Test that the Sender field in the SMTP envelope is not set by Core.
+	 * Test that the Sender field in the SMTP envelope is set by Core.
 	 *
-	 * Correctly setting the Sender requires knowledge that is not available
-	 * to Core. An incorrect value will often lead to messages being rejected
-	 * by the receiving MTA, so it's the admin's responsibility to
-	 * set it correctly.
+	 * A missing Sender field can lead to messages failing DMARC SPF checks.
 	 *
-	 * @ticket 37736
+	 * @ticket 49687
 	 */
-	public function test_wp_mail_sender_not_set() {
-		wp_mail( 'user@example.org', 'Testing the Sender field', 'The Sender field should not have been set.' );
+	public function test_wp_mail_sender_set() {
+		wp_mail( 'user@example.org', 'Testing the Sender field', 'The Sender field should have been set.' );
 
 		$mailer = tests_retrieve_phpmailer_instance();
 
-		$this->assertSame( '', $mailer->Sender );
+		$this->assertSame( 'wordpress@example.org', $mailer->Sender );
 	}
 
 	/**

Original file line number	Diff line number	Diff line change
`@@ -408,21 +408,18 @@ public function test_wp_mail_addresses_arent_encoded() {`
`408`	`408`	`}`
`409`	`409`
`410`	`410`	`/**`
`411`		`- * Test that the Sender field in the SMTP envelope is not set by Core.`
	`411`	`+ * Test that the Sender field in the SMTP envelope is set by Core.`
`412`	`412`	`*`
`413`		`- * Correctly setting the Sender requires knowledge that is not available`
`414`		`- * to Core. An incorrect value will often lead to messages being rejected`
`415`		`- * by the receiving MTA, so it's the admin's responsibility to`
`416`		`- * set it correctly.`
	`413`	`+ * A missing Sender field can lead to messages failing DMARC SPF checks.`
`417`	`414`	`*`
`418`		`- * @ticket 37736`
	`415`	`+ * @ticket 49687`
`419`	`416`	`*/`
`420`		`- public function test_wp_mail_sender_not_set() {`
`421`		`- wp_mail( '[email protected]', 'Testing the Sender field', 'The Sender field should not have been set.' );`
	`417`	`+ public function test_wp_mail_sender_set() {`
	`418`	`+ wp_mail( '[email protected]', 'Testing the Sender field', 'The Sender field should have been set.' );`
`422`	`419`
`423`	`420`	`$mailer = tests_retrieve_phpmailer_instance();`
`424`	`421`
`425`		`- $this->assertSame( '', $mailer->Sender );`
	`422`	`+ $this->assertSame( '[email protected]', $mailer->Sender );`
`426`	`423`	`}`
`427`	`424`
`428`	`425`	`/**`