I have a question on the new Zend security vulnerability announced by Magento recently regarding the email settings in System-> Configuration-> Advanced-> System-> Mail Sending Settings-> Set Return-Path

What exactly does having this set to YES do?

Other than negating the security vulnerability, I would like to understand what feature I'm loosing by setting this to No. I tested this on our staging site by setting it to NO but I see no difference as a user, after I received a sales email, it still can see how it came from the same email address and I could reply to it.

I checked their User Guide, but unfortunately it did not reveal much more.


Under closer inspection I see that the email headers change slightly when I adjust this setting, especially the ones noted below:

When Set to YES

Return-Path: <[email protected]>
From: Sales <[email protected]>


Return-Path: <[email protected]>
From: Sales <[email protected]>

When Set to NO

Return-Path: <[email protected]>
From: Sales <[email protected]>

Now I have a new question how does revealing your IP address & server username by changing the setting to NO help secure your Magento website?

Also, If I swicth from SENDMAIL to POSTFIX, will this solve the problem?

4 Answers 4


Sendmail is a defualt to most Linux OS's and has had vulnerabilities for a few years, a lot of hosting provider turn it off due to this.

If in doubt after setting Return-Path to NO via the admin is to chat with your hosting provider, see if they can change Sendmail daemon NOT to listen on 25/tcp as it instantly protects you from remote Sendmail compromises.

In my experience and emails falling in to customers spam box, there is usually a setting either with them or on your server to prevent this.

As above contact your hosting provider support or email provider if you use one as these will have knowledge on how to sort it, as loads of applications rely on Sendmail by default.


If you set the return-path to NO your emails will have a higher risk to be blocked by some email providers and there is also a higher risk that they will be flagged as spam.

So you get a higher risk that your emails do not reach your customers (order emails, registration etc.).

Revealing your IP address is not a security issue as you can find that info very easy. www-data is the user under which the Apache web server runs.


When Set to YES

Magento uses the email that you've configured in the sales emails for that scope

When Set to NO

Use server default.


Uses the email you've specified, this is Global scope, though.

This happens when your mail server is configured as default (in my experience of Ubuntu, at least)

Try using Postfix on your server - if you use Gmail you can configure it to authenticate your emails, here's a useful guide; https://easyengine.io/tutorials/linux/ubuntu-postfix-gmail-smtp/

  • Your YES outcome is not totally accurate. Consider the method Mage_Core_Model_Email_Template::sendTransactional, which states that when sender info is not explicitly given, to use the configured store email address by type. Most often, this ends up being the "general" contact found in System > Configuration > General > Store Email Addresses. So whatever that value is, which can vary by origin of call, would set the return path. Jan 16, 2017 at 14:54
  • @RickBuczynski good point - I assumed the contact would be populated and set in my answer, thanks for the clarification Jan 18, 2017 at 11:40

A return path of [email protected] doesn't look like a deliverable address.

If so then emails sent by customers clicking reply to an order email wouldn't be delivered - which is not a good outcome!

  • I tested in gmail and even with no Return-Path the reply works
    – Holly
    Jan 16, 2017 at 12:06
  • My mistake. I wasn confuing it with Reply-to.Return-Path is actually the address where non-deliverable messages are sent in the event that the outgoing message can't be delivered. So for your example, in the event that [email protected] isn't a valid mailbox - which appears likely, or in the absence of any other routing on the server to handle email sent to that address, then any diagnostic messages for non-deliverable messages will be lost.
    – David B
    Jan 16, 2017 at 13:34
  • I've just run test myself and Set Return-Path to No and the Return path in subsequent outgoing order emails was unchanged i.e. the same as the From address. There seems to be a discrepancy here between your test and mine!
    – David B
    Jan 16, 2017 at 13:40
  • @DavidB this will be because your server configuration is different. The .internal domain is a result of default sendmail configuration Jan 18, 2017 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.