Email deliverability and form security: best practices
This article explains how email sending works from your website hosted with us, why some messages may end up in spam folders, and what best practices are to ensure the best possible deliverability — as well as to secure your website forms.
The web service outbound IP address: shared and not guaranteed
When a website sends an email directly via the web server — for example using PHP's mail() function, or via WordPress's native sending system (wp_mail()) — the message is sent through the shared IP address of our shared hosting service.
This address has three important limitations:
- It is shared among all websites hosted on the same server. Its reputation therefore does not depend on any specific client: it only takes one neighboring site sending spam or being compromised for the reputation to degrade for everyone.
- It is not declared in your domain configuration. Email providers (Gmail, Outlook, etc.) verify that the sender of a message is authorized to send on behalf of the domain (via SPF and DKIM records). Since our web IP is not listed in these records, the check fails and the message is often classified as spam, or even rejected.
- Its reputation evolves independently of you. You have no control over other uses of this IP.
For these reasons, sending emails from the web service outbound IP is provided "on a best effort basis" (best effort): we cannot guarantee its deliverability. It should not be used for important or high-volume sending.
The best practice: sending via an authenticated email account (SMTP)
The recommended method is to route your website's emails through a real email account for your domain, using an authenticated SMTP connection. The message is then sent through the sending infrastructure of your email service — whether hosted with us, with Swisscenter, or with another provider — whose reputation is managed and whose authentication records are correctly configured.
Concretely, you configure your website (or its sending plugin) with the settings of an existing email account:
- Outgoing SMTP server (for example
mail.votredomaine.ch — the exact value is provided by your email service)
- Port:
587 (STARTTLS encryption, recommended) or 465 (SSL/TLS encryption)
- Authentication enabled, using the full email address as the username and its password
- Sender address corresponding to this same account
The address used as the sender must belong to your domain and match the authenticated account. Avoid using an address from another domain as the sender (for example a @gmail.com address), as this also degrades deliverability.
For WordPress sites
WordPress sends its emails by default via the PHP mail() function, and therefore through the shared IP. To switch to authenticated SMTP sending, simply install a dedicated plugin such as WP Mail SMTP (or equivalent), then enter the parameters above. The configuration takes a few minutes and immediately improves deliverability.
Configuring domain authentication: SPF, DKIM and DMARC
For optimal deliverability, your domain must declare who is authorized to send emails on its behalf. Three records, to be placed in the domain's DNS zone, contribute to this:
- SPF (Sender Policy Framework): indicates the servers authorized to send mail for your domain. By using the SMTP of your email service, your sends are covered by that service's SPF.
- DKIM (DomainKeys Identified Mail): adds a cryptographic signature to each message, proving that it comes from your domain and has not been altered.
- DMARC (Domain-based Message Authentication, Reporting and Conformance): defines the policy to apply to messages that fail SPF/DKIM checks and allows you to receive reports.
If you use our email service, these records are generally already in place or can be easily activated. If your email is managed elsewhere, refer to your provider's documentation to obtain the exact values to enter.
Securing your website forms
Form security is directly linked to deliverability. A poorly protected contact form can be hijacked by robots to send spam in bulk — it is then our sending infrastructure that distributes the spam, which degrades the reputation of the shared IP and penalizes all clients. Protecting your forms is therefore also protecting your deliverability.
Some essential measures:
- Add anti-robot protection: a captcha (for example reCAPTCHA or hCaptcha) or, more discreet for the user, an invisible "honeypot" field (honeypot) that only robots fill out.
- Limit sending rates (rate limiting) to prevent hundreds of submissions in a few seconds.
- Validate and sanitize data server-side, without relying solely on checks performed in the browser.
- Protect against header injection: a form field must never allow the insertion of additional email headers (hidden recipients, etc.). Serious form plugins handle this, provided they are correctly configured.
- Keep your CMS, themes and plugins up to date. The majority of compromised sites are compromised via an obsolete and vulnerable component.
In summary
- The web service outbound IP is shared and not guaranteed: avoid it for important sends.
- Prefer sending via an authenticated email account (SMTP) for your domain.
- On WordPress, use a plugin such as WP Mail SMTP.
- Ensure that SPF, DKIM and DMARC are configured for your domain.
- Secure your forms (anti-robots, rate limiting, server-side validation, header injection protection, regular updates).
If you have any questions about configuring your email or your hosting, our support team remains at your disposal.