Question

I’m creating an email a friend type system where I need our mail server to send emails from the user of the site to their friend, i.e. from [e-mail], to [e-mail].

If, as is the case in this example, the user’s are both part of Gmail the friend would receive an email with the warning “This message may not have been sent by: [e-mail].

I thought that by then adding a ‘sender’ header with our email (e.g. [e-mail]) this should indicate to Gmail that we are the sender and are effectively openly spoofing the sender at their request. Is this true, can you get around Gmail’s warning using the ‘sender’ header?

I realise this is similar to the following question but I’m more interested in whether the sender header should have an effect: Email sent from web server causes gmail to treat as phishing. How to get rid of this?

More info:
I’m using netmailbot to send emails from our mail server using the ‘-customheader’ parameter with ‘sender’ and ‘x-sender’ e.g. ‘-customheader sender:[e-mail] x-sender:[e-mail]’

Answer 1

If gmail doesn’t fail miserably, you have no way to suppress this warning.
Google is in control of both accounts and therefore knows, that this mail wasn’t send by fred using their infrastructure.
There was used some third party infrastructure (yours) and this is all this warning is about.
You can set an arbitrary email address as “from” and Google has no knowledge if this is legitimate use (if fred really wrote the message). Anyone could have written that message. Normally fred would use Googles infrastructure to send mails and then they would know its him.

A cleaner solution would be to put your email address (“[e-mail]”) as from header (that would be honest) and set [e-mail] as reply-to header (so he gets the replies).