diff --git a/server/internal/auth/mailer.go b/server/internal/auth/mailer.go
index 5809b13..a00165c 100644
--- a/server/internal/auth/mailer.go
+++ b/server/internal/auth/mailer.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"log"
+	"net/mail"
 	"net/smtp"
 	"strings"
 )
@@ -40,6 +41,18 @@ type SMTPMailer struct {
 // NewSMTPMailer builds an SMTPMailer.
 func NewSMTPMailer(cfg SMTPConfig) *SMTPMailer { return &SMTPMailer{cfg: cfg} }
 
+// envelopeFrom returns the bare address used for the SMTP envelope (MAIL FROM).
+// cfg.From may carry a display name ("穿山甲 <noreply@x>") for the From: header,
+// but the envelope sender must be a bare address — otherwise servers reject the
+// MAIL FROM with "501 Bad sender address syntax". Falls back to cfg.From when it
+// is already a bare address (ParseAddress still succeeds) or unparseable.
+func (m *SMTPMailer) envelopeFrom() string {
+	if a, err := mail.ParseAddress(m.cfg.From); err == nil {
+		return a.Address
+	}
+	return m.cfg.From
+}
+
 // SendCode delivers the verification code. The message body intentionally
 // contains no product-identifying or destination wording beyond a neutral
 // account-verification notice.
@@ -62,7 +75,7 @@ func (m *SMTPMailer) SendCode(_ context.Context, to, code string) error {
 
 	addr := fmt.Sprintf("%s:%d", m.cfg.Host, m.cfg.Port)
 	auth := smtp.PlainAuth("", m.cfg.Username, m.cfg.Password, m.cfg.Host)
-	if err := smtp.SendMail(addr, auth, m.cfg.From, []string{to}, []byte(msg)); err != nil {
+	if err := smtp.SendMail(addr, auth, m.envelopeFrom(), []string{to}, []byte(msg)); err != nil {
 		return fmt.Errorf("auth: smtp send: %w", err)
 	}
 	return nil
@@ -86,7 +99,7 @@ func (m *SMTPMailer) SendAlreadyRegistered(_ context.Context, to string) error {
 
 	addr := fmt.Sprintf("%s:%d", m.cfg.Host, m.cfg.Port)
 	auth := smtp.PlainAuth("", m.cfg.Username, m.cfg.Password, m.cfg.Host)
-	if err := smtp.SendMail(addr, auth, m.cfg.From, []string{to}, []byte(msg)); err != nil {
+	if err := smtp.SendMail(addr, auth, m.envelopeFrom(), []string{to}, []byte(msg)); err != nil {
 		return fmt.Errorf("auth: smtp send (already-registered): %w", err)
 	}
 	return nil
diff --git a/server/internal/auth/mailer_test.go b/server/internal/auth/mailer_test.go
new file mode 100644
index 0000000..61af6f8
--- /dev/null
+++ b/server/internal/auth/mailer_test.go
@@ -0,0 +1,42 @@
+package auth
+
+import "testing"
+
+// TestEnvelopeFrom guards the "501 Bad sender address syntax" regression:
+// SMTP_FROM may carry a display name for the From: header, but the SMTP
+// envelope sender (MAIL FROM) must be a bare address.
+func TestEnvelopeFrom(t *testing.T) {
+	cases := []struct {
+		name string
+		from string
+		want string
+	}{
+		{"display name + unicode", "穿山甲 <noreply@mail.51yanmei.com>", "noreply@mail.51yanmei.com"},
+		{"display name ascii", "Pangolin <no-reply@pangolin.app>", "no-reply@pangolin.app"},
+		{"bare address", "no-reply@pangolin.app", "no-reply@pangolin.app"},
+		{"angle only", "<noreply@mail.51yanmei.com>", "noreply@mail.51yanmei.com"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			m := NewSMTPMailer(SMTPConfig{From: tc.from})
+			if got := m.envelopeFrom(); got != tc.want {
+				t.Fatalf("envelopeFrom(%q) = %q, want %q", tc.from, got, tc.want)
+			}
+		})
+	}
+}
+
+// TestMaskEmail verifies error-log masking never leaks a full address.
+func TestMaskEmail(t *testing.T) {
+	cases := map[string]string{
+		"chenxin880812@gmail.com": "ch***@gmail.com",
+		"ab@x.com":                "***@x.com",
+		"a@x.com":                 "***@x.com",
+		"not-an-email":            "***",
+	}
+	for in, want := range cases {
+		if got := maskEmail(in); got != want {
+			t.Errorf("maskEmail(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
diff --git a/server/internal/auth/service.go b/server/internal/auth/service.go
index 84f52d2..98d589f 100644
--- a/server/internal/auth/service.go
+++ b/server/internal/auth/service.go
@@ -6,13 +6,29 @@ import (
 	"crypto/subtle"
 	"errors"
 	"fmt"
+	"log/slog"
 	"math/big"
+	"strings"
 	"time"
 
 	"github.com/redis/go-redis/v9"
 	"github.com/wangjia/pangolin/server/internal/apierr"
 )
 
+// maskEmail masks the local part of an email for safe logging (no full PII):
+// "chenxin880812@gmail.com" -> "ch***@gmail.com". Used only in error logs.
+func maskEmail(e string) string {
+	at := strings.IndexByte(e, '@')
+	if at <= 0 {
+		return "***"
+	}
+	local := e[:at]
+	if len(local) <= 2 {
+		return "***" + e[at:]
+	}
+	return local[:2] + "***" + e[at:]
+}
+
 // Redis key helpers for verification codes (doc/03 §4: auth:code:{email}).
 func codeKey(email string) string         { return "auth:code:" + email }
 func codeAttemptsKey(email string) string { return "auth:code:attempts:" + email }
@@ -130,7 +146,10 @@ func (s *Service) SendCode(ctx context.Context, rawEmail, ip string) (retryAfter
 		go func(to string) {
 			sendCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 			defer cancel()
-			_ = s.mailer.SendAlreadyRegistered(sendCtx, to)
+			if err := s.mailer.SendAlreadyRegistered(sendCtx, to); err != nil {
+				slog.Error("auth: send already-registered notice failed",
+					"email", maskEmail(to), "err", err)
+			}
 		}(email)
 		return 0, nil
 	} else if !errors.Is(err, ErrNotFound) {
@@ -154,7 +173,10 @@ func (s *Service) SendCode(ctx context.Context, rawEmail, ip string) (retryAfter
 	go func(to, c string) {
 		sendCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 		defer cancel()
-		_ = s.mailer.SendCode(sendCtx, to, c)
+		if err := s.mailer.SendCode(sendCtx, to, c); err != nil {
+			slog.Error("auth: send verification code failed",
+				"email", maskEmail(to), "err", err)
+		}
 	}(email, code)
 
 	return 0, nil