diff --git a/src/Plugin/MailerTransport/DsnTransport.php b/src/Plugin/MailerTransport/DsnTransport.php
index 872665d364e75357e0ef97b3fae81d42fa53d18f..b1de99ceb77a208dc503affd56e672e870839ccd 100644
--- a/src/Plugin/MailerTransport/DsnTransport.php
+++ b/src/Plugin/MailerTransport/DsnTransport.php
@@ -57,7 +57,7 @@ class DsnTransport extends TransportBase {
       Transport::fromDsn($dsn);
     }
     catch (\Exception $e) {
-      $form_state->setErrorByName('dsn', $this->t('Invalid DSN.'));
+      $form_state->setErrorByName('dsn', $this->t('Invalid DSN: @message', ['@message' => $e->getMessage()]));
     }
   }
 
diff --git a/src/ReplacementSendmailTransportFactory.php b/src/ReplacementSendmailTransportFactory.php
new file mode 100644
index 0000000000000000000000000000000000000000..b256dacca9be66977e66756836fbb9358635cc9a
--- /dev/null
+++ b/src/ReplacementSendmailTransportFactory.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace Drupal\symfony_mailer;
+
+use Drupal\Core\Site\Settings;
+use Symfony\Component\Mailer\Transport\AbstractTransportFactory;
+use Symfony\Component\Mailer\Transport\Dsn;
+use Symfony\Component\Mailer\Transport\SendmailTransportFactory;
+use Symfony\Component\Mailer\Transport\TransportInterface;
+
+/**
+ * Provides a replacement sendmail transport factory that checks the command.
+ */
+final class ReplacementSendmailTransportFactory extends AbstractTransportFactory {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function create(Dsn $dsn): TransportInterface {
+    if ($command = $dsn->getOption('command')) {
+      $commands = Settings::get('mailer_sendmail_commands', []);
+      if (!in_array($command, $commands)) {
+        throw new \RuntimeException("Unsafe sendmail command {$command}");
+      }
+    }
+
+    return (new SendmailTransportFactory())->create($dsn);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function getSupportedSchemes(): array {
+    return ['sendmail', 'sendmail+smtp'];
+  }
+
+}
diff --git a/src/TransportFactoryManager.php b/src/TransportFactoryManager.php
index 7602e48939daa43b434f94c73d3a8d5a1d796d38..0cb3268bb112dbc27035e51e09c7320aa396a0aa 100644
--- a/src/TransportFactoryManager.php
+++ b/src/TransportFactoryManager.php
@@ -3,6 +3,7 @@
 namespace Drupal\symfony_mailer;
 
 use Symfony\Component\Mailer\Transport;
+use Symfony\Component\Mailer\Transport\SendmailTransportFactory;
 use Symfony\Component\Mailer\Transport\TransportFactoryInterface;
 
 /**
@@ -22,6 +23,12 @@ class TransportFactoryManager implements TransportFactoryManagerInterface {
    */
   public function __construct() {
     $this->factories = iterator_to_array(Transport::getDefaultFactories());
+
+    // Replace the sendmail transport factory with our own implementation.
+    $this->factories = array_filter($this->factories, function ($factory) {
+      return !($factory instanceof SendmailTransportFactory);
+    });
+    $this->addFactory(new ReplacementSendmailTransportFactory());
   }
 
   /**