PHP Mailer sending an error of data not accepted

Question

I am having the following error in PHPMailer:

SMTP Error: data not accepted.SMTP server error: DATA END command failed Detail: STOREDRV.Submission.Exception:SendAsDeniedException.MapiExceptionSendAsDenied; Failed to process message due to a permanent exception with message Cannot submit message.

I am using the following:

public function sendEmail($conn, $user, $to_email, $subject, $messageToSent)
    {
        //Check if user exists
        $exist = $this->checkIfUserExist($conn, $user);
        $from = $this->getUserEmail($conn, $user);
        if($exist['exist'])
        {
            // Please specify your Mail Server - Example: mail.example.com.
            //$mail = new PHPMailer\PHPMailer();
            $mail = new PHPMailer\PHPMailer\PHPMailer;                // Passing `true` enables exceptions
            $message = "success";
            try {
                //Server settings
                $mail->SMTPDebug = 2;                                 // set it to 2 to Enable verbose debug output
                $mail->isSMTP();                                      // Set mailer to use SMTP
                $mail->Host = 'smtp.office365.com';                   // Specify main and backup SMTP servers
                $mail->SMTPAuth = true;                               // Enable SMTP authentication
                if($from=='' || $from==null || $from=="NULL")
                {

                    $mail->setFrom('[email protected]');
                }
                if($from!='')
                {

                    $mail->setFrom($from);
                }
                $mail->Username = '[email protected]';     // SMTP username
                $mail->Password = 'xyz';                         // SMTP password
                $mail->SMTPSecure = 'tls';                            // Enable TLS encryption, `ssl` also accepted
                $mail->Port = 587;                                    // TCP port to connect to
                //$mail->AuthType = 'PLAIN';
                //Recipients
                //$mail->setFrom($user.'@abc.com');
                //$mail->setFrom($from);
                $mail->addAddress('[email protected]');     // Add a recipient
                //$mail->addAddress('[email protected]');               // Name is optional
                $mail->addReplyTo('[email protected]', $subject);
                //$mail->addCC('[email protected]');
                //$mail->addBCC('[email protected]');

                //Attachments
                //$mail->addAttachment('/var/tmp/file.tar.gz');         // Add attachments
                //$mail->addAttachment('/tmp/image.jpg', 'new.jpg');    // Optional name

                //Content
                $mail->isHTML(true);                                  // Set email format to HTML
                $mail->Subject = $subject;
                if($from=="[email protected]")
                {
                    $mail->Body = $messageToSent. '<p>The user asking for password recovery does not have a valid email. Thus, the sender will be shown as sent from the admin email. The user have the following ID: </p><h3>'.$exist['user_id'].'</h3>';
                }
                else
                {
                    $mail->Body = $messageToSent. '<p>The user have the following ID: </p><h3>'.$exist['user_id'].'</h3>';

                }
                $mail->AltBody = 'Please take actions according to needs.';

                if($mail->send())
                {
                    echo json_encode($message);
                }
                else
                {
                    echo json_encode($mail->ErrorInfo);
                }

            } catch (Exception $e) {
                echo 'Message could not be sent. Mailer Error: ', $mail->ErrorInfo;
            }
        }
        else
        {
            echo json_encode("UserDoesntExist"); 
        }

    }

I've read here that the $mail->Username and $mail->setFrom should be the same, but in this way, we should get passwords for each email to change $mail->Password.

Answer 1

The clue is in the name of the exception: SendAsDenied; it's saying you cannot use anything other than your Username as the From address, especially not arbitrary (forged) addresses.

If you want to avoid forgery problems, send from your admin address, but set the user's address as a reply-to. That way you're not forging, and replies will go to the right place.