Web Hosting - Email sending best practices

Objective

To ensure your emails reach your recipients, OVHcloud maintains a dedicated outbound infrastructure, with automatic anti-spam filtering and continuous monitoring of server reputation. To make the most of it, we recommend sending your emails through authenticated SMTP rather than the native PHP mail() function. This approach gives every email a verifiable identity, which significantly improves deliverability and reduces the risk of being classified as spam.

This guide explains OVHcloud's best practices and recommendations for sending emails reliably and securely from a shared hosting plan, whether you manage a WordPress site, another CMS, or a PHP application.

Requirements

• An OVHcloud Web Hosting plan.
• An email address attached to your domain name (MX Plan, Email Pro, or Exchange solution). If you do not have one yet, refer to the guide Creating an email address with an MX Plan solution.

OVHcloud Control Panel Access

• Direct link: Hosting plans
• Navigation path: Web Cloud > Hosting plans > Select your web hosting plan

Instructions

1. mail() or authenticated SMTP: what difference does it make for you?

What OVHcloud does to protect your sending

OVHcloud continuously monitors the reputation of its sending servers and automatically filters suspicious messages — so your legitimate emails do not suffer. But this protection has a limit: the PHP mail() function does not check the sender identity declared in the email (the From: field). An email sent through mail() can therefore appear to come from any address, which is enough to trigger the filters of recipient servers (Gmail, Outlook, etc.) and compromise the deliverability of your own emails.

Emails without a reliable signature

The mail() function sends emails without guaranteeing the sender's identity. Recipient servers (Gmail, Outlook, etc.) verify that the email genuinely comes from a server authorised by your domain, using the SPF and DKIM records. With mail(), this verification often fails: the message may then land in spam or be rejected.

Sending through authenticated SMTP solves this problem: the email is issued by the OVHcloud server authorised for your domain, with the correct signature.

Open forms: an additional abuse vector

A publicly accessible contact form with no protection mechanism is a prime target for bots. They exploit it to send thousands of emails within minutes through your hosting, causing the shared IP address to be blocked and harming every client on the cluster.

Set up the following protections on any form that triggers an email:

• Captcha: integrate a verification system (Google reCAPTCHA v3, hCaptcha, or a simple arithmetic challenge) to block automated submissions.
• Rate limiting: limit the number of sends per IP address on the server side to prevent burst abuse.
• Strict input validation: check and sanitise every form field before using it in an email — never trust user-supplied data.

2. The best practice: use an OVHcloud email account with authenticated SMTP

Principle

Send your emails through an authenticated SMTP connection to the OVHcloud mail server, using an email account attached to your domain (for example contact@mydomain.ovh).

This approach offers three major benefits:

• Guaranteed authentication: the OVHcloud server verifies your identity before accepting the email.
• Working SPF and DKIM: the email is issued by a server authorised for your domain and signed correctly.
• Traceability: every send is tied to an identified account, so you can act quickly in case of abuse.

Why the From: field must belong to your domain

The From: field of your email must contain an address belonging to your domain (for example contact@mydomain.ovh), and this address must match the SMTP account used for authentication.

If the From: does not match the domain authorised in the SPF record, or if the DKIM signature does not match, the recipient mail servers (Gmail, Outlook, etc.) may reject the email or classify it as spam.

Contact forms: fixed From: field and user Reply-To:

A common mistake is to place the email address entered by the user in the form directly in the From: field. For example, a visitor enters user@gmail.com and the script uses this address as the sender.

This behaviour is incorrect for two reasons:

• Your domain's SPF record does not authorise Gmail servers (or any other third-party provider) to send on your behalf → SPF check failure.
• You are sending "on behalf of" an address that does not belong to you → high risk of being classified as spam or rejected.

The correct pattern for a contact form:

This way, when you reply to the email you received, your mail client sends the reply to the user's address via the Reply-To: field, without compromising SPF/DKIM authentication.

Here is how to adapt the PHPMailer example for a contact form:

// User-supplied data (validate and sanitise before use)
$userEmail = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$userName  = htmlspecialchars(strip_tags($_POST['name']));
$message   = htmlspecialchars(strip_tags($_POST['message']));

if (!$userEmail) {
    die('Invalid email address.');
}

// From: always fixed — your site's address, never the user's
$mail->setFrom('contact@mydomain.ovh', 'My Website');

// Reply-To: the user's address, so you can reply to them directly
$mail->addReplyTo($userEmail, $userName);

// Recipient: yourself (you receive the form message)
$mail->addAddress('contact@mydomain.ovh', 'My Website');

$mail->Subject = '[Contact] ' . $userName;
$mail->Body    = "Name: $userName\nEmail: $userEmail\n\nMessage:\n$message";

OVHcloud SMTP settings

Use the following settings for your MX Plan email account (included with your web hosting):

Where to find your SMTP credentials

The SMTP username is your full email address (for example contact@mydomain.ovh).

The password is the one set when the address was created, or changed from the OVHcloud Control Panel. If you have forgotten it or want to reset it, refer to the guide Changing the password of an email account.

PHP code example with PHPMailer

PHPMailer is the reference PHP library for sending emails through SMTP. Install it via Composer:

composer require phpmailer/phpmailer

Here is a complete example of authenticated SMTP sending:

<?php
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;

require 'vendor/autoload.php';

$mail = new PHPMailer(true);

try {
    // OVHcloud SMTP server settings
    $mail->isSMTP();
    $mail->Host       = 'smtp.mail.ovh.net';
    $mail->SMTPAuth   = true;
    $mail->Username   = 'contact@mydomain.ovh'; // Your OVHcloud email address
    $mail->Password   = 'your_password';         // Password of the email account
    $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS; // SSL/TLS
    $mail->Port       = 465;

    // Sender: must belong to your domain
    $mail->setFrom('contact@mydomain.ovh', 'My Website');
    $mail->addReplyTo('contact@mydomain.ovh', 'My Website');

    // Recipient
    $mail->addAddress('mary.johnson@example.com', 'Recipient Name');

    // Content
    $mail->isHTML(true);
    $mail->Subject = 'Your email subject';
    $mail->Body    = 'Email body in <b>HTML</b>';
    $mail->AltBody = 'Email body in plain text (fallback)';

    $mail->send();
    echo 'Email sent successfully.';
} catch (Exception $e) {
    echo "Error while sending: {$mail->ErrorInfo}";
}

3. WordPress and other CMSs: use an SMTP plugin

3.1 The problem with WordPress by default

The wp_mail() function in WordPress uses the PHP mail() function behind the scenes. It therefore inherits all the problems described in the previous section: no authentication, uncontrolled From:, spam risk.

The solution is to install an SMTP plugin that replaces wp_mail() with an authenticated SMTP connection to your OVHcloud mail server.

3.2 Configuring WP Mail SMTP

WP Mail SMTP is the most widely used plugin for this configuration.

Installation:

1. In your WordPress administration, go to Plugins > Add New Plugin.
2. Search for WP Mail SMTP and click Install Now, then Activate.

Configuration:

1. Go to WP Mail SMTP > Settings in the administration menu.
2. In the From section, fill in the following fields:

3. In the Mailer section, select Other SMTP.
4. Fill in the SMTP settings:

5. Click Save Settings.
6. In the Tools tab, use Email Test to check the configuration.

3.3 Alternative: FluentSMTP

FluentSMTP is a lightweight, free alternative with no limit on sending volume.

Installation:

1. In your WordPress administration, go to Plugins > Add New Plugin.
2. Search for FluentSMTP and click Install Now, then Activate.

Configuration:

1. Go to FluentSMTP > Settings.
2. Click Add Connection and select Other SMTP.
3. Fill in the same settings as for WP Mail SMTP:

4. Click Save Connection, then send a test email.

3.4 Other CMSs (Drupal, Joomla, PrestaShop)

The principle is the same for any CMS or framework: replace the native sending function with a module or an authenticated SMTP configuration.

In all cases, the SMTP settings are the same: server smtp.mail.ovh.net, port 465 (SSL/TLS) or 587 (STARTTLS), with authentication using the full email address and its password.

Go further

Monitoring and managing automated emails in your web hosting plan

How to improve email security with an SPF record

How to improve email security with a DKIM record

How to improve email security with a DMARC record

For specialised services (SEO, development, etc.), contact the OVHcloud partners.

If you would like assistance using and configuring your OVHcloud solutions, please take a look at our support offers.

Join our community of users.