SPF
A TXT record listing the servers allowed to send for your domain. Include every relay you use, and keep it under the 10 DNS-lookup limit.
An SMTP server sends outgoing email using the Simple Mail Transfer Protocol: it accepts your message, looks up the recipient domain's MX record and relays the mail there. Mail clients and websites should submit on port 587 (STARTTLS) or 465 (implicit TLS); port 25 is reserved for server-to-server relay and usually blocked for users.
For site owners and office admins setting up mail clients, contact forms or WordPress mail and trying to work out why messages fail or land in spam.
Last editorial update: 14 November 2026.
An SMTP server accepts an outgoing message, finds the server responsible for the recipient's domain and hands the message over using the Simple Mail Transfer Protocol (RFC 5321). It queues mail it cannot deliver yet, retries on a schedule and sends a bounce if delivery finally fails.
The protocol is a plain-text dialogue. The client greets the server with EHLO, declares the envelope sender with MAIL FROM, each recipient with RCPT TO, then sends headers and body after DATA. Every server reply begins with a three-digit code: 2xx means accepted, 4xx means try again later, 5xx means a permanent refusal.
S: 220 mail.example.in ESMTP ready
C: EHLO shop.example.in
S: 250-mail.example.in
S: 250 STARTTLS
C: MAIL FROM:<orders@example.in>
S: 250 OK
C: RCPT TO:<buyer@gmail.com>
S: 250 Accepted
C: DATA
S: 354 End data with <CR><LF>.<CR><LF>
SMTP only moves mail. It does not store an inbox or decide what you read; that is the job of IMAP or POP3, compared in the POP3 vs IMAP guide.
A message passes through at least two SMTP hops: your client submits it to your provider's server, and that server relays it to the recipient's MX host. DNS sits between the two hops and tells the sending server where to go.
This is why the outgoing SMTP hostname in your mail settings is often different from the hostname in your MX record. The MX record decides who receives your domain's mail; the SMTP host decides who sends it.
Use port 587 with STARTTLS or port 465 with implicit TLS in any mail client or website; leave port 25 to server-to-server relay. RFC 6409 defines 587 for message submission, and RFC 8314 recommends implicit TLS on 465.
| Port | Role | Encryption | Login required |
|---|---|---|---|
| 25 | Relay between mail servers | Opportunistic STARTTLS | No (but most ISPs block it for end users) |
| 465 | Client submission | TLS from the first byte | Yes |
| 587 | Client submission | STARTTLS after EHLO | Yes |
| 2525 | Unofficial fallback some relays offer | Usually STARTTLS | Yes |
A classic symptom: webmail sends fine but Outlook times out. The profile is still set to port 25, which the office or broadband network blocks. Change it to 587, STARTTLS and "my server requires authentication", and the same mailbox starts sending.
SMTP authentication proves you own the mailbox before the server agrees to send for you, and TLS stops the password and message being read in transit. Without both, a submission server would be an open relay that spammers find within days.
A rejected login returns code 535. If you see 535 after a password change, update every device and plugin that stores the old password, because one stale phone can lock the mailbox after repeated failures.
Route contact forms and order emails through an authenticated SMTP connection instead of PHP's mail() function. mail() hands the message to the local mail agent with no login, so the From domain often fails SPF alignment and the message lands in spam or vanishes.
In WordPress, an SMTP plugin replaces wp_mail()'s default transport. Enter the provider's outgoing host, port 587 or 465, the full mailbox address and its password, and set the From address to that same mailbox. Send a test to a Gmail address and open "Show original" to confirm SPF, DKIM and DMARC all read PASS.
Personal Gmail SMTP works for a low-volume form with an app password, but its daily cap and the gmail.com sender make it a poor fit for invoices. A mailbox on your own domain through WebJi® business email hosting sends with authenticated SMTP from an address that can pass SPF and DKIM.
Receivers judge the sending domain first, so mail from a domain without SPF, DKIM and DMARC is filtered no matter how clean the wording is. Gmail and Yahoo have required authentication from bulk senders since February 2024.
A TXT record listing the servers allowed to send for your domain. Include every relay you use, and keep it under the 10 DNS-lookup limit.
A cryptographic signature added to each message, verified against a public key in DNS. The DKIM guide shows the selector record.
A policy telling receivers what to do when SPF or DKIM fails and where to send reports. Start at p=none, then tighten.
The exact record syntax is in the SPF and DMARC setup guide. A reverse DNS (PTR) record matching the sending hostname and a clean blocklist history complete the picture.
The reply code tells you whether to fix credentials, DNS, content or volume, so read it before touching anything. A 4xx code is temporary and the server will retry; a 5xx code is final and needs a change on your side.
| Code | Meaning | Usual fix |
|---|---|---|
| 421 | Service unavailable or too many connections | Slow the sending rate; move bulk mail to a dedicated relay |
| 450 / 451 | Mailbox busy or temporary local error, often greylisting | Wait; the queue retries automatically |
| 535 | Authentication failed | Full address as username; app password if 2FA is on |
| 550 | Mailbox unavailable or relay denied | Check the address; match From to the logged-in mailbox (see fixing 550 errors) |
| 552 | Message exceeds size limit | Send a download link instead of a large attachment |
| 554 | Transaction failed, often a spam or blocklist rejection | Fix SPF/DKIM, then check the sending IP on a blocklist |
A connection that hangs with no code at all is almost always a blocked port rather than a wrong password. You can confirm from a terminal with openssl s_client -connect smtp.example.in:465 for implicit TLS, or openssl s_client -starttls smtp -connect smtp.example.in:587 for STARTTLS; a certificate and a 220 greeting mean the path is open.
Not exactly. "Mail server" usually means the whole system: an SMTP service that sends and receives between servers, plus IMAP or POP3 for reading. Your outgoing SMTP host and your incoming IMAP host may share a hostname or use different ones.
No. Port 465 was briefly withdrawn in the late 1990s, but RFC 8314 (2018) re-registered it for submission over implicit TLS and recommends it. Both 465 and 587 are correct today; pick whichever your provider documents.
Port 25 needs no login, so compromised scripts use it to send spam directly, which gets the whole server's IP blocklisted. Hosts close it for customer accounts and ask you to submit through an authenticated server on 587 or 465 instead.
Yes, with Postfix or Exim, but you must set a PTR record, SPF, DKIM and DMARC, and warm up a fresh IP slowly. Many VPS providers also keep port 25 closed until you request it. For most businesses a hosted mailbox is less work.
TLS encrypts each hop in transit, not the stored message. If a hop falls back to plain text, or the recipient's server is compromised, the content is readable. End-to-end protection needs S/MIME or PGP on top of SMTP.
Checked 14 November 2026 against RFC 5321, RFC 6409 and RFC 8314 · Reviewed by the WebJi® team, Jaipur.
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.