Why mail leaves from the address it arrived on verifiedcriticalWritten by the Hub
Mail handed to the built-in SMTP server goes out from the address it was handed to — unless a default address list is configured, which replaces the rule entirely.
In detail
The mechanism has three participants. smtp-ip decides which addresses accept mail; smtp-mappable-ips decides which of those also become sending addresses, and ships covering everything; smtp-unmappable-ips subtracts loopback and private ranges. When a message arrives on a mappable address, that address is attached to it as the address to send from, and no pool, tag or JSON is involved. This is the cheapest way there is to choose a sending address: an existing mailer picks one by opening a connection to it. For Hub it means an EMA can drive per-address sending without knowing that MailerQ exists — a property PowerMTA achieves only through virtual MTAs and explicit configuration. The exception matters as much as the rule. smtp-default-ips does not act as a fallback: setting it switches the mapping off, and every submitted message is sent from the listed addresses regardless of where it came in. That is measured behaviour, not documentation, and it is the difference between "these addresses are used when nothing else applies" and "these addresses are used, full stop".