phacility/phabricator · warning · PhabricatorMetaMTAReceivedMailProcessingException

err:bad-user

err:bad-user

Error message

This mail is addressed to the private email address of an object ("%s"), but you are not the user who is authorized to use the address you sent mail to. Each private address is unique to the user who received the original mail. Try replying to a message which was sent directly to you instead.

What it means

Thrown by PhabricatorObjectMailReceiver when the mail is addressed to a PRIVATE object address (one carrying a numeric sender identifier) but the authenticated sender's user ID does not equal the identifier embedded in the address. Each private reply address is minted for exactly one recipient, and the check $sender_identifier != $sender->getID() enforces that only the user who originally received the notification can use it. Failure raises STATUS_USER_MISMATCH.

Source

Thrown at src/applications/metamta/receiver/PhabricatorObjectMailReceiver.php:84

    }

    $sender_identifier = $parts['sender'];
    if ($sender_identifier === 'public') {
      if (!PhabricatorEnv::getEnvConfig('metamta.public-replies')) {
        throw new PhabricatorMetaMTAReceivedMailProcessingException(
          MetaMTAReceivedMailStatus::STATUS_NO_PUBLIC_MAIL,
          pht(
            'This mail is addressed to the public email address of an object '.
            '("%s"), but public replies are not enabled on this server. An '.
            'administrator may have recently disabled this setting, or you '.
            'may have replied to an old message. Try replying to a more '.
            'recent message instead.',
            $pattern));
      }
      $check_phid = $object->getPHID();
    } else {
      if ($sender_identifier != $sender->getID()) {
        throw new PhabricatorMetaMTAReceivedMailProcessingException(
          MetaMTAReceivedMailStatus::STATUS_USER_MISMATCH,
          pht(
            'This mail is addressed to the private email address of an object '.
            '("%s"), but you are not the user who is authorized to use the '.
            'address you sent mail to. Each private address is unique to the '.
            'user who received the original mail. Try replying to a message '.
            'which was sent directly to you instead.',
            $pattern));
      }
      $check_phid = $sender->getPHID();
    }

    $mail_key = PhabricatorMetaMTAMailProperties::loadMailKey($object);
    $expect_hash = self::computeMailHash($mail_key, $check_phid);

    if (!phutil_hashes_are_identical($expect_hash, $parts['hash'])) {
      throw new PhabricatorMetaMTAReceivedMailProcessingException(
        MetaMTAReceivedMailStatus::STATUS_HASH_MISMATCH,

View on GitHub (pinned to 5720a38cfe)

Solutions

Reply from the same Phabricator account the notification was addressed to — i.e., reply to a message that was sent directly to you (its address encodes your user id).
If the wrong person must respond, have them interact via the web UI instead, or subscribe them so they receive their own private address.
Admins: verify the sender's From address resolves to the expected account (People > the user's verified email addresses) — a stale/unverified primary email can make the sender resolve to a different user id.
If you own multiple accounts, send the reply from the mailbox that matches the account that got the notification.

Example fix

// before: user 202 replies to address minted for user 456
// To: D123+456+e3b0c4@phabricator.example
// From: user-202@example.com -> err:bad-user

// after: user 456 replies from their own mailbox
// To: D123+456+e3b0c4@phabricator.example
// From: user-456@example.com -> accepted, check_phid = sender PHID

Defensive patterns

Strategy: validation

Validate before calling

// Before sending, confirm the From mailbox belongs to the account the address was minted for:
// (receiver pattern local part is D<id>+<sender-id>+<hash>)
$parts = PhabricatorObjectMailReceiver::parseAddressLocalPart($local);
$expectedUserId = (int)$parts['sender'];
$sender = id(new PhabricatorUserEmail())
  ->loadViewerOwnerByEmail($from_address); // resolve account for the From address
if ($parts['sender'] !== 'public' && (!$sender || $sender->getID() !== $expectedUserId)) {
  // do not send: reply from the matching account instead
}

Prevention

Reply only to mail delivered directly to your own mailbox; never reuse another recipient's address from a reply-all.
Keep exactly one Phabricator account per person and send from its verified address.
Strip object reply addresses from shared mailing lists and aliases.

When it happens

Trigger: Calling loadReceiver / processReceivedMail where the receiver pattern's sender part (from PhabricatorObjectMailReceiver::getMailAddressPattern, e.g. D123+456+hash@) has user id 456, but the 'From' address resolves (via lookup by verified email) to a different PhabricatorUser whose getID() is not 456. Concretely: user B hits reply-all on a notification that was sent only to user A, or a user changed their primary email and replies from a second account.

Common situations: Reply-all on a ticket notification CC'd list where one recipient's private address survives in the To/CC line; shared mailbox or mailing list where the original recipient's address is visible to others; forwarding a notification to a colleague who replies directly; one person owning two accounts and replying from the wrong one.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/6edafb6c71035b54. Report an issue: GitHub.