This article explains how email sending works from your website hosted with us, why some messages may end up in spam folders, and what best practices are to ensure the best possible deliverability, as well as to secure your website forms.
In short: sending directly with mail() goes through a shared infrastructure, with no guaranteed deliverability. Send instead via authenticated SMTP from an email account of your domain, with SPF, DKIM and DMARC configured, and protect your forms.
What to know before you start
- To send emails with PHP's
mail() function, the function must first be enabled in your website's PHP configuration (option Enable PHP mail function). See Send emails from a PHP script (mail() function or SMTP).
- Emails sent with
mail() from your website go through a filtering outbound gateway, shared between hosted websites, which rejects the most common spam.
Is sending directly from the web server guaranteed?
When a website sends an email directly via the web server, for example using PHP's mail() function or via WordPress's native sending system (wp_mail()), the message is sent through the shared sending infrastructure of our shared hosting service.
This way of sending has three important limitations:
- It is shared among all hosted websites. Its reputation therefore does not depend on any specific client: it only takes one neighboring site sending spam or being compromised for the reputation to degrade for everyone.
- It must be authorized by your domain's SPF record. Email providers (Gmail, Outlook, etc.) verify that the sender of a message is authorized to send on behalf of the domain (via SPF and DKIM records). If your domain's SPF does not contain
include:fwdsc.swisscenter.com, mail sent by your websites is not authorized, and the message is often classified as spam, or even rejected. The SPF created by our tools already contains it; if your email is hosted elsewhere, add it yourself (see Configuring DKIM, SPF and DMARC to keep your e-mails out of the spam folder).
- Its reputation evolves independently of you. You have no control over other uses of this infrastructure.
For these reasons, sending emails directly from the web server is provided on a best effort basis: we cannot guarantee its deliverability. It should not be used for important or high-volume sending.
How do I send via an authenticated email account (SMTP)?
The recommended method is to route your website's emails through a real email account for your domain, using an authenticated SMTP connection. The message is then sent through the sending infrastructure of your email service, whether hosted with us or with another provider, whose reputation is managed and whose authentication records are correctly configured.
Concretely, you configure your website (or its sending plugin) with the settings of an existing email account:
- Outgoing SMTP server: for email hosted with us,
mail01.swisscenter.com (the exact name is shown in the Apanel console, see Email settings for all email clients (IMAP, POP, SMTP)); for email hosted elsewhere, the value provided by your email service
- Port:
465 (SSL/TLS encryption, recommended) or 587 (STARTTLS encryption)
- Authentication enabled, using the full email address as the username and its password
- Sender address corresponding to this same account
The address used as the sender must belong to your domain and match the authenticated account. Avoid using an address from another domain as the sender (for example a @gmail.com address), as this also degrades deliverability.
For WordPress sites
WordPress sends its emails by default via the PHP mail() function, and therefore through the shared infrastructure. To switch to authenticated SMTP sending, simply install a dedicated plugin such as WP Mail SMTP (or equivalent), then enter the parameters above. The configuration takes a few minutes and immediately improves deliverability.
How do I configure SPF, DKIM and DMARC for my domain?
For optimal deliverability, your domain must declare who is authorized to send emails on its behalf. Three records, to be placed in the domain's DNS zone, contribute to this:
- SPF (Sender Policy Framework): indicates the servers authorized to send mail for your domain. By using the SMTP of your email service, your sends are covered by that service's SPF.
- DKIM (DomainKeys Identified Mail): adds a cryptographic signature to each message, proving that it comes from your domain and has not been altered.
- DMARC (Domain-based Message Authentication, Reporting and Conformance): defines the policy to apply to messages that fail SPF/DKIM checks and allows you to receive reports.
If you use our email service, the Apanel console enables DKIM and creates SPF and DMARC for you, and a diagnostic tells you what is missing: see Configuring DKIM, SPF and DMARC to keep your e-mails out of the spam folder. If your email is managed elsewhere, refer to your provider's documentation to obtain the exact values to enter.
How do I secure my website forms?
Form security is directly linked to deliverability. A poorly protected contact form can be hijacked by robots to send spam in bulk: it is then our sending infrastructure that distributes the spam, which degrades its reputation and penalizes all clients. Protecting your forms is therefore also protecting your deliverability.
Some essential measures:
- Add anti-robot protection: a captcha (for example reCAPTCHA or hCaptcha) or, more discreet for the user, an invisible "honeypot" field that only robots fill out.
- Limit sending rates (rate limiting) to prevent hundreds of submissions in a few seconds.
- Validate and sanitize data server-side, without relying solely on checks performed in the browser.
- Protect against header injection: a form field must never allow the insertion of additional email headers (hidden recipients, etc.). Serious form plugins handle this, provided they are correctly configured.
- Keep your CMS, themes and plugins up to date. The majority of compromised sites are compromised via an obsolete and vulnerable component.
In summary
- Sending directly from the web server is shared and not guaranteed: avoid it for important sends.
- Prefer sending via an authenticated email account (SMTP) for your domain.
- On WordPress, use a plugin such as WP Mail SMTP.
- Ensure that SPF, DKIM and DMARC are configured for your domain.
- Secure your forms (anti-robots, rate limiting, server-side validation, header injection protection, regular updates).
Troubleshooting
- Your website's sending was blocked after a form abuse: contact our support to have it unblocked once the form is protected.
- Your messages are classified as spam or rejected: open the Mail DNS diagnostics block described in Configuring DKIM, SPF and DMARC to keep your e-mails out of the spam folder and fix what it reports.
- To check from the outside that your SPF authorizes your websites' sending, especially useful if your email is elsewhere, analyze your domain with diag.swisscenter.com (the tool is in French): in the Sécurité E-mail (email security) card, the SPF (Sender Policy Framework) line should contain
include:fwdsc.swisscenter.com, without the Ignoré par les récepteurs (ignored by receivers) badge. See Diagnose your domain and email with the SwissCenter diagnostic tool.
- For any other question about configuring your email or your hosting, contact our support.
Going further