Description
Hi Mailu team,
We've encountered an issue with the WILDCARD_SENDERS environment variable in the latest version (2024.06), where it appears that only the first email address in the comma-separated list is being respected.
🔍 How to reproduce
Set the environment variable as follows in .env:
WILDCARD_SENDERS=sales@mydomain.com,notifications@mydomain.com
Restart Mailu.
Authenticate SMTP using a valid user (e.g. erp@mydomain.com).
Try sending:
An email with From: sales@mydomain.com → works
An email with From: notifications@mydomain.com → ❌ rejected with:
Sender address rejected: User unknown in virtual mailbox table
✅ Expected behavior
All addresses listed in WILDCARD_SENDERS should be allowed as spoofed senders for users authenticated via SMTP.
💡 Additional notes
We've confirmed this behavior is consistent and reproducible.
If we reverse the order (notifications@mydomain.com,sales@mydomain.com), then only notifications@ works, and sales@ is rejected.
It looks like the value is either being truncated, or only the first element is parsed correctly.
🧪 Environment
Mailu version: 2024.06 (Docker)
TLS_FLAVOR: letsencrypt
Tested via authenticated SMTP from Odoo and via swaks.
Please let us know if there's any workaround or if we can help further. Thanks for your great work!