# Configuring MAIL FROM: **URL:** \ **Category:** Zeek\ **Created:** [December 3, 2012, 5:45pm UTC](https://community.zeek.org/t/configuring-mail-from/2507 "2012-12-03T17:45:39Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Paul\_Halliday](https://avatars.discourse-cdn.com/v4/letter/p/838e76/32.png) [@Paul\_Halliday](https://community.zeek.org/u/Paul_Halliday)\ **Post date:** [December 3, 2012, 5:45pm UTC](https://community.zeek.org/t/configuring-mail-from/2507/1 "2012-12-03T17:45:39Z")
Stumped! Where does bro get the host value from? This is the error I am getting: Dec 3 13:01:12 host sSMTP[7223]: MAIL FROM:\ Dec 3 13:01:12 host sSMTP[7223]: 504 Need Fully Qualified Address I need 'host' to expand to 'host.my.domain' Thanks. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [December 3, 2012, 6:39pm UTC](https://community.zeek.org/t/configuring-mail-from/2507/2 "2012-12-03T18:39:19Z")
Technically from the "hostname" command by default. You can change it by using a FQDN in broctl.cfg like this… mailfrom = Big Brother \<[bro@yourserver.com](mailto:bro@yourserver.com)\>   .Seth ---
**Author:** ![Paul\_Halliday](https://avatars.discourse-cdn.com/v4/letter/p/838e76/32.png) [@Paul\_Halliday](https://community.zeek.org/u/Paul_Halliday)\ **Post date:** [December 4, 2012, 7:24pm UTC](https://community.zeek.org/t/configuring-mail-from/2507/3 "2012-12-04T19:24:18Z")
Should it be mailfrom or MailFrom? either way it didn't appear to influence anything. I did fix it so that `hostname` now returns host.domain.ca. this didn't help either. I turned on debugging for ssmtp: Dec 4 14:01:21 hostname sSMTP[75788]: Set Root="postmaster" Dec 4 14:01:21 hostname sSMTP[75788]: Set MailHub="mail.domain.ca" Dec 4 14:01:21 hostname sSMTP[75788]: Set RemotePort="25" Dec 4 14:01:21 hostname sSMTP[75788]: Set RewriteDomain="domain.ca" Dec 4 14:01:21 hostname sSMTP[75788]: Set HostName="hostname.nscc.ca" Dec 4 14:01:21 hostname sSMTP[75788]: Set FromLineOverride="True" Dec 4 14:01:21 hostname sSMTP[75788]: Set MailHub="mail.domain.ca" Dec 4 14:01:21 hostname sSMTP[75788]: via SMTP Port Number="25" Dec 4 14:01:21 hostname sSMTP[75788]: 220 mail.domain.ca ESMTP (blahblahblahblah) Dec 4 14:01:21 hostname sSMTP[75788]: HELO hostname.domain.ca Dec 4 14:01:21 hostname sSMTP[75788]: 250 mail.domain.ca Hello hostname.domain.ca [1.2.3.4], pleased to meet you Dec 4 14:01:21 hostname sSMTP[75788]: MAIL FROM:\ Dec 4 14:01:21 hostname sSMTP[75788]: 504 Need Fully Qualified Address Dec 4 14:01:21 hostname sSMTP[75788]: 504 Need Fully Qualified Address Just doing: `mail me@domain.ca` from the command line works. Thoughts? Thanks. ---
**Author:** ![Castle\_Shane](https://avatars.discourse-cdn.com/v4/letter/c/3ab097/32.png) [@Castle\_Shane](https://community.zeek.org/u/Castle_Shane)\ **Post date:** [December 4, 2012, 7:57pm UTC](https://community.zeek.org/t/configuring-mail-from/2507/4 "2012-12-04T19:57:52Z")
Hmm - I found this in ./base/frameworks/notice/mail.bro:         ## Address that emails will be from.         const mail\_from = "Big Brother \" &redef;         ## Reply-to address used in outbound email.         const reply\_to = "" &redef; So it looks like you need to add   redef Notice::mail\_from = "Big Brother \"; to your local.bro, and possibly change "reply\_to" as well. Then run broctl check;broctl install;broctl restart (wash, rinse, spin) as usual. ---
**Author:** ![Paul\_Halliday](https://avatars.discourse-cdn.com/v4/letter/p/838e76/32.png) [@Paul\_Halliday](https://community.zeek.org/u/Paul_Halliday)\ **Post date:** [December 5, 2012, 2:16pm UTC](https://community.zeek.org/t/configuring-mail-from/2507/5 "2012-12-05T14:16:19Z")
Worked like a charm. Thanks! ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [December 5, 2012, 2:19pm UTC](https://community.zeek.org/t/configuring-mail-from/2507/6 "2012-12-05T14:19:28Z")
The mailfrom (or MailFrom, it's case insensitive) option in broctl.cfg actually sets this same variable. It's likely overwriting what you are setting in local.bro anyway. 🙂 Glad it's working now.   .Seth ---
**Author:** ![Castle\_Shane](https://avatars.discourse-cdn.com/v4/letter/c/3ab097/32.png) [@Castle\_Shane](https://community.zeek.org/u/Castle_Shane)\ **Post date:** [December 5, 2012, 7:45pm UTC](https://community.zeek.org/t/configuring-mail-from/2507/7 "2012-12-05T19:45:25Z")
I browsed some of the broctl doc online, and glanced at the source code, and what Seth says is correct - the mods to broctl.cfg should have done the job. I can only surmise that the broctl.cfg you modified was not the one that was being used, or perhaps the wash-rinse-spin sequence failed somehow. Hmm the only thing I can't find is how the Notice::mail\_from var is set given the info in the mailfrom config var. That one escapes me. Running "broctl config" shows it but it is not what is being used by Notice, as far as I can tell. ---
**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\ **Post date:** [December 5, 2012, 8:05pm UTC](https://community.zeek.org/t/configuring-mail-from/2507/8 "2012-12-05T20:05:50Z")
> Hmm the only thing I can't find is how the Notice::mail\_from var is set given the info in the mailfrom config var. That one escapes me. Running "broctl config" shows it but it is not what is being used by Notice, as far as I can tell. There's code in BroControl/install.py that automatically adds associated "redefs" for some config options when doing `broctl install`, but I don't see one that uses MailFrom to add a "redef Notice::mail\_from=…". So I think that's a bug.     Jon ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [December 5, 2012, 9:02pm UTC](https://community.zeek.org/t/configuring-mail-from/2507/9 "2012-12-05T21:02:36Z")
Arg! Thanks Jon.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/configuring-mail-from/2507/10 "2022-05-06T15:40:41Z")