Magento SMTP vs PHP mail(): Why Your Emails Need a Relay
Magento SMTP vs PHP mail(): the short answer
Use authenticated SMTP. Magento 2.4 does not actually default to PHP mail() — it defaults to the local sendmail transport with authentication set to none, which fails for the same reasons: no authentication, no sending reputation you control, no SPF/DKIM alignment and no log you can check. Authenticated SMTP through a real provider gives you all four.
The frustrating part is that unauthenticated local delivery often works on day one. Messages go out, confirmations arrive, everyone moves on. Then it quietly degrades: some providers start filing your mail as junk, others refuse it outright, and because nothing is logged, the first sign of trouble is a customer ringing to ask where their order confirmation went.
How Magento 2 sends email by default
Out of the box, Magento hands every email — order confirmations, invoices, shipment notices, password resets — to the sendmail transport with authentication set to none, which passes the message to whatever mail transfer agent the web server happens to have. (Older guidance says PHP mail(); the effect on deliverability is identical, and on many hosts sendmail is itself a thin wrapper.) There is no authentication, no sending reputation you control, usually no DKIM signature, and no record of what was sent or whether it failed. The receiving server sees mail from an anonymous web box and treats it accordingly.
PHP mail() vs authenticated SMTP, side by side
| Magento's unauthenticated default | Authenticated SMTP | |
|---|---|---|
| Authentication | None | Username/password or OAuth 2.0 |
| Sending reputation | Your web server's (effectively none) | Your provider's dedicated infrastructure |
| SPF / DKIM alignment | Rarely correct | Provider gives you the exact DNS records |
| Visibility | No log — failures are silent | Every send logged, failures visible |
| Credential handling | None to manage | Stored credentials, or OAuth with no stored password |
| When something breaks | You find out from customers | You find out from the log |
What Magento 2.4 includes natively — and what it misses
Magento 2.4 does ship a basic SMTP transport, configured under Stores → Configuration → Advanced → System → Mail Sending Settings: you can point it at a host and port and supply credentials. For a small store with a patient administrator that may be enough to get off unauthenticated local delivery.
What it does not give you is everything around the connection: no OAuth 2.0 — a problem, since Google Workspace and Microsoft 365 both steer senders away from stored passwords — no provider presets, no test-send button to prove the configuration works, and no log of what was actually sent. You configure it blind and verify it by placing orders.
What a proper SMTP setup adds
Our SMTP for Magento 2 module fills those gaps from the same admin: pick from 19 provider presets with host, port and encryption auto-filled, authenticate with LOGIN/PLAIN/CRAM-MD5 or OAuth 2.0 (XOAUTH2) for Google Workspace and Microsoft 365, send a test email directly from the configuration screen, and keep a full log of every message so "did it send?" has an answer you can look up. Credentials are stored encrypted.
Choosing where to relay through
Any reputable SMTP provider works; the choice is between a transactional email service built for volume and the mailbox provider you already pay for. A dedicated transactional service gives you the strongest reputation and reporting; Google Workspace or Microsoft 365 is perfectly serviceable for modest volume and keeps everything in one account — ideally authenticated over OAuth rather than a stored password. Whichever you choose, use its documented SMTP settings and its documented DNS records, not values copied from a forum post.
Switching in five steps
- Create or identify the sending account with your chosen provider, using an address on your store's own domain.
- Configure the SMTP connection in the Magento admin — host, port, encryption and authentication method.
- Publish the provider's SPF, DKIM and DMARC records for your domain before sending real mail through it.
- Align the addresses at Stores → Configuration → General → Store Email Addresses with that domain, then run
bin/magento cache:flush. - Send a test message and read the headers — Gmail's "Show original" shows SPF, DKIM and DMARC results in plain text.
Two settings people forget
First, the Return-Path. Stores → Configuration → Advanced → System → Mail Sending Settings includes a Set Return-Path option — the address bounces come back to. Point it at a mailbox somebody actually reads, on your sending domain, and hard bounces stop disappearing into the void: an undeliverable customer address is something you want to know about before the customer rings.
Second, the log is only useful if someone looks at it. A send log turns email from an act of faith into something you can audit — but build the habit of checking it after any configuration change, template edit or provider incident. Thirty seconds of scanning for failures beats a week of not knowing.
SMTP is half the job — DNS is the other half
SMTP fixes the sending path; SPF, DKIM and DMARC prove to receivers that the mail is yours. Skip the DNS records and even a perfectly configured relay can land in junk. The full deliverability checklist — cron, sender alignment, header checks and the diagnosis table — is in Magento Order Emails Not Sending or in Spam: The Complete Fix.
FAQ
Does Magento 2 support SMTP natively?
Partially. Magento 2.4 has a basic SMTP transport under Stores → Configuration → Advanced → System → Mail Sending Settings — host, port and credentials — but no OAuth 2.0, no presets, no test button and no send log, which is why most stores add a dedicated module.
Which SMTP providers work with Magento 2?
Any provider that offers authenticated SMTP. SMTP for Magento 2 ships presets for 19 common providers and supports custom hosts; Google Workspace and Microsoft 365 can authenticate with OAuth 2.0 instead of a stored password.
Will switching to SMTP stop my emails going to spam?
It removes the structural causes — no authentication, no reputation, no DKIM — which are the most common ones. Pair it with correct SPF, DKIM and DMARC records; content-level triggers are a separate, smaller problem. It targets Magento Open Source 2.4.9 on PHP 8.4 and 8.5.
Does SMTP change what my emails look like?
No. SMTP replaces the transport — how the message travels — not the content. Your email templates, branding and order details render exactly as before; the difference is whether the message reaches the inbox.
Once delivery is solid, it is worth tidying what the emails contain, starting with the number every confirmation leads with — see Magento 2 Custom Order Number. SMTP for Magento 2 is a one-off licence — no subscription; pricing is on the module page — and it is included in the AgenticEcom Suite.