@@ -115,6 +115,10 @@ EMAIL_FROM="noreply@programmier.bar"
 EMAIL_TRANSPORT="sendmail"
 EMAIL_SENDMAIL_NEW_LINE="unix"
 
+# Reply-To for every mail Directus sends (set by the bundle's `mail-reply-to` hook), since
+# EMAIL_FROM cannot receive replies. Unset or empty: mails go out without Reply-To.
+# EMAIL_REPLY_TO="podcast@programmier.bar"
+
 # For production SMTP (Gmail):
 # EMAIL_TRANSPORT="smtp"
 # EMAIL_SMTP_HOST="smtp.gmail.com"
 
@@ -32,6 +32,11 @@
                 "name": "process-guard",
                 "source": "src/process-guard/index.ts"
             },
+            {
+                "type": "hook",
+                "name": "mail-reply-to",
+                "source": "src/mail-reply-to/index.ts"
+            },
             {
                 "type": "hook",
                 "name": "deploy-website",
 
@@ -0,0 +1,44 @@
+import { describe, expect, jest, test } from '@jest/globals'
+import registerHook from '../index.ts'
+
+// The extensions SDK ships as ESM and is not transformed under Jest's CJS mode,
+// so stub it. The real `defineHook` simply returns its callback.
+jest.mock('@directus/extensions-sdk', () => ({
+    defineHook: (callback: unknown) => callback,
+}))
+
+type Filter = (payload: any, meta: any, context: any) => any
+
+function setup(env: Record<string, unknown>) {
+    const filters = new Map<string, Filter>()
+    registerHook(
+        { filter: (event: string, handler: Filter) => filters.set(event, handler) } as any,
+        { env, logger: { info: jest.fn() } } as any
+    )
+    return filters
+}
+
+describe('mail-reply-to hook', () => {
+    test('sets Reply-To from EMAIL_REPLY_TO', () => {
+        const filter = setup({ EMAIL_REPLY_TO: ' replies@example.com ' }).get('email.send')!
+        const message = { to: 'a@example.com', subject: 'Hi', html: '<p>Hi</p>' }
+
+        expect(filter(message, {}, {})).toEqual({ ...message, replyTo: 'replies@example.com' })
+        // The original message is not mutated.
+        expect(message).not.toHaveProperty('replyTo')
+    })
+
+    test('keeps a Reply-To the caller set', () => {
+        const filter = setup({ EMAIL_REPLY_TO: 'replies@example.com' }).get('email.send')!
+        const message = { to: 'a@example.com', subject: 'Hi', replyTo: 'speaker@example.com' }
+
+        expect(filter(message, {}, {})).toBe(message)
+    })
+
+    test.each([[{}], [{ EMAIL_REPLY_TO: '' }], [{ EMAIL_REPLY_TO: '   ' }]])(
+        'registers no filter when EMAIL_REPLY_TO is unset or empty (%j)',
+        (env) => {
+            expect(setup(env).has('email.send')).toBe(false)
+        }
+    )
+})
@@ -0,0 +1,28 @@
+import { defineHook } from '@directus/extensions-sdk'
+
+const HOOK_NAME = 'mail-reply-to'
+
+/** Directus env var holding the address replies to CMS mails should go to. */
+export const EMAIL_REPLY_TO_ENV = 'EMAIL_REPLY_TO'
+
+/**
+ * Mails are sent from `EMAIL_FROM`, an address that cannot receive mail. Directus has no
+ * setting for a default Reply-To, so this filter adds `EMAIL_REPLY_TO` to every mail that
+ * goes through the MailService (`email.send` runs before each send): the bundle's own mails
+ * (tickets, speaker portal, newsletter), Directus system mails (password reset, invites)
+ * and Flows. A Reply-To set by the caller is kept. Unset or empty: no change.
+ */
+export default defineHook(({ filter }, { env, logger }) => {
+    const replyTo = typeof env[EMAIL_REPLY_TO_ENV] === 'string' ? env[EMAIL_REPLY_TO_ENV].trim() : ''
+    if (!replyTo) {
+        logger.info(`${HOOK_NAME} hook: ${EMAIL_REPLY_TO_ENV} is not set, mails are sent without Reply-To.`)
+        return
+    }
+
+    filter('email.send', (message: any) => {
+        if (!message || message.replyTo) {
+            return message
+        }
+        return { ...message, replyTo }
+    })
+})
@@ -333,7 +333,7 @@ would differ from what is sent. The only content filter is the renderer's publis
   `sendRawEmail`/`sendTemplatedEmail` in `src/shared/email-service.ts` (MailService passes it to
   nodemailer). No `mailto:` entry, because no mailbox processes unsubscribe mails. Plus `X-Mailin-custom: newsletter:test` / `X-Mailin-Tag: newsletter-test`
   for the Brevo webhook (see "Bounces and complaints"). From address: Directus
-  `EMAIL_FROM`, as for all CMS mail.
+  `EMAIL_FROM`, Reply-To: `EMAIL_REPLY_TO` (if set, `mail-reply-to` hook), as for all CMS mail.
 - **One-click on the website**: `nuxt-app/server/routes/newsletter/unsubscribe.post.ts` serves the same URL
   as the page. A POST with body `List-Unsubscribe=One-Click` (urlencoded or `multipart/form-data`, both
   allowed by RFC 8058) takes the token from the query, opts out and answers 200 (500 on a technical error) instead of the form's 303 redirect.
 
@@ -31,6 +31,7 @@ The flow consists of four main phases:
 | `STORAGE_LOCATIONS` | Comma-separated storage location IDs (first is used for invoice PDFs) | Yes |
 | `INVOICE_FILES_FOLDER` | Id of the `directus_files` folder invoice PDFs are uploaded into; the Public policy must not read it (see [Invoice File Privacy](#invoice-file-privacy)). Unset or invalid: invoices still upload, but into the public library (warning + Slack alert) | Yes |
 | Email transport config | Directus email settings (`EMAIL_TRANSPORT`, `EMAIL_SMTP_HOST`, etc.) | Yes |
+| `EMAIL_REPLY_TO` | Reply-To added to every mail Directus sends (`mail-reply-to` hook), so replies reach a real inbox instead of `EMAIL_FROM`. A Reply-To set by the sender is kept; unset or empty: no Reply-To | No |
 | `ACCOUNTING_INVOICE_EMAIL` | Accounting mailbox that receives a copy of every invoice document (see [Accounting copy](#accounting-copy)). Unset/empty: no copy is sent (Slack is alerted once per process start) | Production |
 
 ## External Services