Web Hosting - Email sending best practices

Objective

Your web hosting plan offers two ways of sending emails from your website: the native PHP mail() function, which uses the outgoing mail servers of your hosting plan, and authenticated SMTP through an email account attached to your domain. Both are legitimate. mail() is the default method: it needs no configuration, is subject to a quota per hosting plan and is monitored from your OVHcloud Control Panel. Authenticated SMTP is the alternative when you need to control the sender identity: the From: address is bound to an authenticated account and the email carries your domain's signature. Its quotas apply per email account and per source IP address, shared across the hosting cluster.

This guide helps you choose between the two methods and explains how to configure authenticated SMTP sending from a shared hosting plan, whether you manage a WordPress site, another CMS, or a PHP application.

Requirements

• An OVHcloud Web Hosting plan.
• For authenticated SMTP only: an email address attached to your domain name (MX Plan, Email Pro, or Exchange solution). If you do not have one yet, refer to the guide Creating an email address with an MX Plan solution.

OVHcloud Control Panel Access

• Direct link: Hosting plans
• Navigation path: Web Cloud > Hosting plans > Select your web hosting plan

Instructions

1. mail() or authenticated SMTP: which one should you use?

Both methods send emails from your website. They differ in:

• the server the email is sent from,
• the sending limits,
• how you monitor them.

Whichever method you choose:

• Recipient servers (Gmail, Outlook, etc.) check that the From: domain authorises the sending server. Keep your SPF, DKIM and DMARC records correct in your DNS zone.
• Sending abuse or spam from your hosting plan or from your email account leads to an automatic block. If your emails are no longer sent, refer to the guide Monitoring and managing automated emails in your web hosting plan.
• The total size of an email cannot exceed 10 MB, headers and encoding included.

Open forms: an abuse vector for both methods

A publicly accessible contact form with no protection mechanism is a prime target for bots. Bots exploit it to send thousands of emails in minutes, which gets the shared IP address blocked and harms every customer on the cluster.

Set up the following protections on any form that triggers an email:

• Captcha: integrate a verification system (Google reCAPTCHA v3, hCaptcha, or a simple arithmetic challenge) to block automated submissions.
• Rate limiting: limit the number of sends per IP address on the server side to prevent burst abuse.
• Strict input validation: sanitise every form field before using it in an email — never trust user-supplied data.

2. Configuring authenticated SMTP with an OVHcloud email account

Principle

Send your emails through an authenticated SMTP connection to the OVHcloud mail server, using an email account attached to your domain (for example contact@mydomain.ovh).

This approach offers three major benefits:

• Guaranteed authentication: the OVHcloud server verifies your identity before accepting the email.
• SPF and DKIM: the email is issued by a server authorised for your domain and signed with DKIM if DKIM is enabled for your domain.
• One identified account: every send is tied to a single email account, whose password you can change at any time to stop an abusive script or plugin.

Sending with mail(): the domain must be attached to your hosting plan

To send emails from your hosting plan with the PHP mail() function, the domain used in the From: field must be attached to your hosting plan.

This domain does not have to be managed in your OVHcloud account: you can use a domain registered with another registrar, as long as it is attached to your hosting plan, which is what proves you are authorised to send emails on its behalf.

Why the From: field must belong to your domain

The From: field of your email must contain an address belonging to your domain (for example contact@mydomain.ovh), and this address must match the SMTP account used for authentication.

If the From: does not match the domain authorised in the SPF record, or if the DKIM signature does not match, the recipient mail servers (Gmail, Outlook, etc.) may reject the email or classify it as spam.

Contact forms: fixed From: field and user Reply-To:

A common mistake is to put the address the user entered in the form straight into the From: field. For example, a visitor enters user@gmail.com and the script uses this address as the sender.

This behaviour is incorrect for two reasons:

• Your domain's SPF record does not authorise Gmail servers (or any other third-party provider) to send on your behalf → SPF check failure.
• You are sending "on behalf of" an address that does not belong to you → high risk of being classified as spam or rejected.

The correct pattern for a contact form:

When you reply, your mail client uses the Reply-To: address instead, without compromising SPF/DKIM authentication.

Here is how to adapt the PHPMailer example for a contact form:

// User-supplied data (validate and sanitise before use)
$userEmail = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$userName  = htmlspecialchars(strip_tags($_POST['name']));
$message   = htmlspecialchars(strip_tags($_POST['message']));

if (!$userEmail) {
    die('Invalid email address.');
}

// From: always fixed — your site's address, never the user's
$mail->setFrom('contact@mydomain.ovh', 'My Website');

// Reply-To: the user's address, so you can reply to them directly
$mail->addReplyTo($userEmail, $userName);

// Recipient: yourself (you receive the form message)
$mail->addAddress('contact@mydomain.ovh', 'My Website');

$mail->Subject = '[Contact] ' . $userName;
$mail->Body    = "Name: $userName\nEmail: $userEmail\n\nMessage:\n$message";

OVHcloud SMTP settings

Use the following settings for your MX Plan email account (included with your web hosting):

Where to find your SMTP credentials

The SMTP username is your full email address (for example contact@mydomain.ovh).

The password is the one set when the address was created, or changed from the OVHcloud Control Panel. If you have forgotten it or want to reset it, refer to the guide Changing the password of an email account.

PHP code example with PHPMailer

PHPMailer is the reference PHP library for sending emails through SMTP. Install it via Composer:

composer require phpmailer/phpmailer

Here is a complete example of authenticated SMTP sending:

<?php
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;

require 'vendor/autoload.php';

$mail = new PHPMailer(true);

try {
    // OVHcloud SMTP server settings
    $mail->isSMTP();
    $mail->Host       = 'smtp.mail.ovh.net';
    $mail->SMTPAuth   = true;
    $mail->Username   = 'contact@mydomain.ovh'; // Your OVHcloud email address
    $mail->Password   = 'your_password';         // Password of the email account
    $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS; // SSL/TLS
    $mail->Port       = 465;

    // Sender: must belong to your domain
    $mail->setFrom('contact@mydomain.ovh', 'My Website');
    $mail->addReplyTo('contact@mydomain.ovh', 'My Website');

    // Recipient
    $mail->addAddress('mary.johnson@example.com', 'Recipient Name');

    // Content
    $mail->isHTML(true);
    $mail->Subject = 'Your email subject';
    $mail->Body    = 'Email body in <b>HTML</b>';
    $mail->AltBody = 'Email body in plain text (fallback)';

    $mail->send();
    echo 'Email sent successfully.';
} catch (Exception $e) {
    echo "Error while sending: {$mail->ErrorInfo}";
}

3. WordPress and other CMSs: use an SMTP plugin

3.1 How WordPress sends emails by default

The wp_mail() function in WordPress uses the PHP mail() function behind the scenes, with a From: address set by WordPress or by each plugin. These sends therefore count against your hosting plan quota, and you can monitor them from the OVHcloud Control Panel.

For a fixed, authenticated sender on every email from your site, install an SMTP plugin that replaces wp_mail() with an authenticated SMTP connection to your OVHcloud mail server.

3.2 Configuring WP Mail SMTP

WP Mail SMTP is the most widely used plugin for this configuration.

Installation:

1. In your WordPress administration, go to Plugins > Add New Plugin.
2. Search for WP Mail SMTP and click Install Now, then Activate.

Configuration:

1. Go to WP Mail SMTP > Settings in the administration menu.
2. In the From section, fill in the following fields:

3. In the Mailer section, select Other SMTP.
4. Fill in the SMTP settings:

5. Click Save Settings.
6. In the Tools tab, use Email Test to check the configuration.

3.3 Alternative: FluentSMTP

FluentSMTP is a lightweight, free alternative. Your email account's sending quota applies in the same way.

Installation:

1. In your WordPress administration, go to Plugins > Add New Plugin.
2. Search for FluentSMTP and click Install Now, then Activate.

Configuration:

1. Go to FluentSMTP > Settings.
2. Click Add Connection and select Other SMTP.
3. Fill in the same settings as for WP Mail SMTP:

4. Click Save Connection, then send a test email.

3.4 Other CMSs (Drupal, Joomla, PrestaShop)

The principle is the same for any CMS or framework: replace the native sending function with a module or an authenticated SMTP configuration.

In all cases, the SMTP settings are the same: server smtp.mail.ovh.net, port 465 (SSL/TLS) or 587 (STARTTLS), with authentication using the full email address and its password.

Go further

Monitoring and managing automated emails in your web hosting plan

Technical specifications of web hosting plans

How to improve email security with an SPF record

How to improve email security with a DKIM record

How to improve email security with a DMARC record

For specialised services (SEO, development, etc.), contact the OVHcloud partners.

If you would like assistance using and configuring your OVHcloud solutions, please take a look at our support offers.

Join our community of users.