If your order confirmations land in spam, customers call, resend requests pile up, and trust erodes. Default PHP mail from a web server has terrible deliverability - the fix is a proper SMTP provider plus correct domain authentication. This is an afternoon’s work that permanently fixes a channel. Here is the setup.
Why Server Mail Fails
PHP’s mail() or a local sendmail sends from the web server’s IP: no reputation history, no rDNS alignment, no SPF authorisation. Mailbox providers treat it as suspicious by default. Any shared host or cloud VM IP makes it worse - cloud IP ranges are spam-heavy neighbourhoods.
Choose a Transactional SMTP Provider
The usual suspects, all solid for transactional volume: Amazon SES (cheapest at scale), SendGrid, Mailgun, Postmark (deliverability-focused), Brevo. Pick on price and existing stack; the Magento side is the same for all - an SMTP module (the community standard is Mageplaza SMTP or equivalents) configured with the provider’s host, port, and credentials.
The DNS Triad: SPF, DKIM, DMARC
This is where deliverability is actually decided. For your sending domain:
SPF - authorises the provider’s servers to send for you:
v=spf1 include:amazonses.com ~all
(one SPF record total - merge includes if you use multiple providers)
DKIM - the provider gives you selector records to publish; their servers sign mail, mailbox providers verify against your DNS. Your provider’s docs walk through it; it is three CNAMEs, typically.
DMARC - policy and reporting:
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
Start at p=none to observe, move to quarantine then reject once reports confirm legitimate mail passes. Since Google/Yahoo’s 2024 sender requirements, DMARC is effectively mandatory for bulk senders.
Magento-Side Checklist
- SMTP module configured, test email sent and headers inspected (SPF/DKIM/DMARC all PASS in the received headers)
- Sender addresses on the authenticated domain - sending as a Gmail address through your SMTP is a spoofing signal
- Email queue via cron healthy; failed-mail alerts watched
- Newsletter/marketing volume ideally on a subdomain (
mail.example.com) so campaign reputation never endangers transactional mail
Monitor, Don’t Assume
Deliverability decays silently: a DNS change, a reputation hit from a bad campaign. Monitor with your provider’s dashboards (bounce and complaint rates - keep complaints under 0.1 percent) and periodic seed-list inbox tests. When placement drops, the DMARC reports and provider dashboards tell you which leg broke.
Transactional email is critical infrastructure disguised as a settings screen. Provider SMTP, authenticated domain, monitored reputation - do the afternoon of work once and order emails stop being a support topic.