PHP Mail vs SMTP
How PHP mail() and SMTP Send Email Differently
PHP mail vs SMTP compares two ways a website can send email. PHP's mail() function passes each message to a local mail program on the server, while authenticated SMTP connects to a mail server that checks the sender's login before accepting the message.
With mail(), the message usually leaves from the web server's own IP address and carries whatever From address the script sets. Nothing proves that the website is allowed to send for that domain, and the receiving server has little information to judge the message by.
Why Mail From a Website Often Fails Authentication
Mailbox providers check whether a sending server is allowed to send for the domain in the From address, using the records described in SPF vs DKIM vs DMARC. Mail sent with mail() from a shared web server often has no SPF record covering its IP address and no DKIM signature. The server address may also have been used by many other sites, some of them for spam.
The result is a message that fails authentication, which raises the chance of spam filtering. A well-written message can still land in the spam folder for these reasons.
Authenticated SMTP changes this. The script logs in to a mail server, the server can sign the message with DKIM, and the message leaves from a server the domain's records allow. Sending through a relay is explained in what an SMTP relay is.
Frequently asked questions
Is PHP mail() insecure?
It is not necessarily dangerous, but it is unauthenticated. The function does not verify who is sending, so a script on a compromised or poorly configured site can send mail that looks legitimate. Authenticated SMTP gives the receiving server a way to check the sender before accepting the message.
Why does email from my website go to spam?
The most common causes are missing or failing authentication records, a From address that does not match the sending domain, and a shared sending IP address with a poor reputation. Switching to authenticated SMTP and aligning the sending domain with its records usually improves delivery, although it cannot guarantee it.