Sending e-mail from PHP: mail() or SMTP

Use SMTP with a real mailbox on your domain. The mail() function is fine for a quick test, but it returns “sent” only because the local mail program accepted the message, not because it arrived. With SMTP there is authentication, there are errors you can read, and the messages are far less likely to end up in spam.

The two ways, side by side

mail() SMTP
How it leaves Handed to the server’s mail program, with no authentication. Your code logs in to a mailbox with a user and password and sends through it.
When it fails PHP says “true” anyway. You learn nothing. There are clear errors: wrong password, wrong port, sender refused.
Spam Sender and server rarely match, which filters notice. The sender is a mailbox on your domain, which has SPF and DKIM on its side.
Set-up None in the code. Server, port, user, password and encryption.

Moving to SMTP

1 Create a mailbox just for the site’s sending, for example site@your-domain. See creating an e-mail account in cPanel.
2 Look up that mailbox’s settings under Email Accounts in cPanel: the outgoing server, the port and the encryption. SMTP with SSL uses port 465. The user is the full address.
3 Use a library rather than speaking the protocol by hand. PHPMailer takes a few lines: see sending e-mail with PHPMailer. In WordPress, making WordPress send e-mail properly, with SMTP.
4 Set the From address equal to the mailbox that logs in, or to the same domain. A sender from a domain that is not yours (a Gmail address, say) is the quickest way to the spam folder.
5 Send a test message to an address of yours at another provider and see whether it reached the inbox or the spam folder.
An open form is a spam cannon. If your script lets whoever uses it choose the recipient, the sender or the subject without checking, someone will use it to send spam through your account, and the server ends up on a blocklist. Validate what comes from the form, and fix the recipient in the code. If it has already happened, see your server IP on a blocklist.
Even with the right SMTP, the domain has to be set up properly. Without SPF, DKIM and DMARC messages look suspicious: see SPF, DKIM and DMARC. There are sending limits per hour and behaviour rules: writing an e-mail that does not land in spam. And cPanel has Track Delivery, where you see where each message went.

The form says “sent” and the message never arrives? Tell us the sending address, the destination and the time.

Open a support ticket

SEE ALSO

Sending e-mail from your own code with PHPMailer

A contact form that actually reaches your inbox

Why your e-mail is not sending or receiving

SPF, DKIM and DMARC: why your e-mail lands in spam

RECOMMENDED PRODUCT

Professional e-mail on your domain

Mailboxes in your company name, no adverts, with spam filtering. from KSh858.00/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

How to change your PHP version You can choose which PHP version your site runs on, from the older releases up to the most recent ones, and turn extensi...
Which technologies run here: PHP, Node, Python, Perl, games and the limits «My developer asks whether you support X.» This page answers that in one go, with names and versions - and it also says...
Viewing and adjusting your PHP configuration: version per folder, extensions and phpinfo Changing a whole site's PHP version is easy and is covered in how to change your PHP version. This article is the next s...
PHP limits: memory, time, upload size and the one that fails silently «I cannot upload the image.» «The import stops halfway.» «The menu lost half its items after saving.» Three different co...
Where the PHP error log is, how to read it, and the errors you will see most When a site breaks there are two ways to react: guess, or read what the server already wrote down. The second is faster...
A blank page in PHP: how to see the error A white page means PHP hit a fatal error and is set not to show it. That is the right setting for a public site, which i...