Authenticated SMTP for custom domain email: complete guide

Quick answer for authenticated SMTP custom domain

Authenticated SMTP custom domain sending is a paid hop. Verify the domain. Prove inbound MX. Delete leftover MX. Upgrade off Free. Create one credential. Set From to an identity you actually created. Probe from a mailbox you do not own. Read the SMTP reply if it fails.

The words people mix are three jobs. Authenticated SMTP is the login that submits mail. Send as custom domain is the Header From a stranger sees. SMTP relay, in mailbox-host language, is often the suite login for a hosted store. If you already live in Gmail, you want the first two. You do not want a second IMAP password.

MailerZ is inbound MX plus authenticated SMTP, operated by Secuno LLC. Envelope Sender Rewriting Scheme only. Header From, Subject, Date, Message-ID, body, and MIME are never rewritten. Unhosted or unauthorized send is SMTP 550 / 550 5.7.1. Leftover MX is a hard stop. Self-send from Gmail to the same Gmail account can lie. Not Google Workspace. Not SOC 2. Not HIPAA.

Transport still follows IETF RFC 5321 — Simple Mail Transfer Protocol. Authentication is an extension on that session, not a separate product. The practical rule: copy the dashboard pair. Do not invent a hostname because a blog used 587 last year.

What authenticated SMTP is

SMTP is a conversation. The client says who it is submitting as. The server says yes, later, or no. Without authentication, that conversation is how open relays used to work: anyone who could reach port 25 could offer a From. Receivers spent twenty years teaching the internet to stop that. Authenticated SMTP is the boring fix. The client presents a secret. The server ties that secret to a small set of approved identities.

For a custom domain, the identity is not “whoever typed a From line.” It is hello@, billing@, or another local-part you created after the zone was verified. Catch-all inbound does not mint a From. An alias that only receives is not automatically allowed to send. Those are two lists.

The client can be Gmail Send mail as, Outlook’s SMTP identity, Thunderbird, a WordPress plugin, a cron host, or an app you wrote. The protocol does not care. The policy does. A password in a ticket is still a password. A From you never created is still 550.

People call this “SMTP relay” because older hosts used that phrase. In a Microsoft 365 article, relay often means the suite will accept mail from a printer if the tenant says so. In a MailerZ article, the same English means: authenticate, offer an approved domain From, stay inside hourly and monthly ceilings. The printer story and the domain-identity story share a port number. They do not share a product.

Authenticated SMTP is also not a campaign ESP. There is no list manager, no unsubscribe header factory, no complaint feedback loop product. If you need that, buy that. Using a delivery-layer credential as a newsletter pump burns the hourly ceiling and then your reputation. MailerZ publishes both hourly send-as and monthly outgoing. They apply at the same time.

Why forwarding is not send as custom domain

MX tells the world where inbound mail for the domain should land. You publish one set. You delete leftovers. A sender looks up MX, connects, and offers a recipient. That is receive. It does not authorize you to originate mail as the same domain.

Teams finish the inbound cut and assume reply will “just work.” Gmail will reply as the Gmail address unless you attach Send mail as. Outlook will do the same. A contact form will send as whatever the plugin was last pointed at. None of those clients become domain senders because MX is green.

MailerZ inbound keeps Header From intact and rewrites only the envelope return path with SRS. That is how a forwarded message still looks like it came from the original person. Outbound is the opposite direction. You are the author. Header From should be your domain identity. SPF and DKIM must match that claim. Forwarding lore does not publish those records for you.

If hello@ does not receive from the outside, do not celebrate that SMTP AUTH worked. Replies and “please confirm” loops use the same printed address. Prove both directions before you put the address on an invoice. The inbound half is documented on email forwarding. This article stays on the send hop.

Cloudflare Email Routing, registrar forwarding, and leftover Google MX are inbound products. They do not replace authenticated SMTP. A comparison that says “routing is enough” is answering a receive question. Ask the send question separately.

The SMTP session, without folklore

A useful mental model is five checks, in order. Reachability. TLS. AUTH. MAIL FROM / From identity. Recipient and rate policy. Teams debug the fifth check while the second is still wrong.

Reachability is DNS and a firewall. If the host name the dashboard shows does not resolve, or port 587 is blocked on a cheap VPS, you never get a banner. That is not a MailerZ identity problem.

TLS is a pair with the port. STARTTLS on one port and implicit TLS on another are not interchangeable. Mixing them fails before a body exists. Copy the dashboard. The longer explanation of the pair lives in other articles on this site. This guide only needs the rule: do not mix a remembered port with a guessed encryption label.

AUTH is the secret. Username is often not the From address. Password is a generated string, not the Gmail password and not the MailerZ website login. If AUTH fails, stop. You do not have a deliverability problem. You have a copied field problem, a revoked credential, or a Free plan.

Identity is next. The server accepted the secret. It still rejects a From you never created, a domain that is not on the account, or send-as while the workspace is still Free. That refusal is 550 5.7.1 more often than people expect. It is the product working.

Policy is last. Hourly send-as and monthly outgoing both apply. A burst of password-reset mail can trip 20 per hour on Solo even when the month still has room. A scraped form can burn the month. Unauthorized recipients are 550. MailerZ is not an open relay.

Log the reply code and the enhanced status if the client shows it. “Did not arrive” is not a diagnosis. 421, 450, and 550 are different jobs. Retry forever on 550 is how you look like an abuser. Retry with backoff on 4xx is normal. Details of each code belong in the error articles. Here, save the text.

From, envelope, and the records that must agree

Header From is what humans and many filters treat as the author. Envelope MAIL FROM / Return-Path is where bounces go and where SPF is evaluated. They can differ. On inbound forwarding, MailerZ may rewrite only the envelope. On outbound send-as, you should not invent a cute mismatch “to hide the real sender.” Site From, visitor Reply-To if needed, envelope as the dashboard instructs.

SPF lists hosts allowed to use the domain in the envelope. DKIM signs a body and selected headers. DMARC asks whether From aligns with those proofs. The documents are IETF RFC 7208 — Sender Policy Framework (SPF), IETF RFC 6376 — DomainKeys Identified Mail (DKIM), and IETF RFC 7489 — Domain-based Message Authentication, Reporting, and Conformance (DMARC). Publish one SPF TXT. Do not create a second SPF record because a wizard offered a snippet. Two SPF records is a common self-own.

DKIM needs a selector the dashboard shows. Paste that TXT at the name it specifies. A green “DKIM pass” in a third-party checker is still not inbox placement. Receiving systems use reputation, user buttons, and their own rules. MailerZ does not sell a Primary-tab guarantee.

DMARC at p=none is observation. Quarantine and reject are later, after you can read reports and you know senders. Do not jump to reject because a blog said it looks mature. A forgotten form still sending as the domain will fail loudly.

Leftover MX does not break AUTH. It breaks the reply. A customer answers your domain From and the message lands at old Google MX. You will swear SMTP works and inbound is “fine in tests.” Tests that email yourself are the usual liar. Probe from another mailbox. Treat leftover MX as a hard stop.

Setup that stays honest

Client click-paths change. Gmail’s Send mail as labels move. Outlook’s account dialog is a different product every year. This guide does not replace MailerZ docs or Google’s own article. It is the order of operations that still holds when the buttons move.

1. Add and verify the domain. Create the printed local-parts you will send as. Map destinations. Publish one MX set. Delete leftover hosts. Probe inbound from a mailbox you do not own.
2. Leave Free if you need send-as. Solo is the smallest paid plan at $40 per year. Confirm MailerZ pricing.
3. Create one SMTP credential per app or per contractor. Name it so revocation is obvious.
4. Copy host, port, encryption, username, and password together. Set From to an approved identity. Do not paste a Gmail password.
5. Send one message with a unique subject to an outside mailbox. Confirm Header From, the destination, and delivery history.
6. Confirm a wrong password fails closed. Confirm an unapproved From is 550. Do not paper over that with a public relay.
7. Rate limit forms and crons. Watch hourly and monthly counters. Revoke the secret when the person or plugin leaves.

Gmail users attach Send mail as using Google’s flow. See Google Gmail Help — Send mail from a different address for the client clicks. Outlook users who stay in Microsoft’s world should read Microsoft Learn — Send email from a device or app using Microsoft 365 when the suite is the sender. If MailerZ is the sender, the identity is still the dashboard pair, not the Microsoft mailbox password.

Human reply and app send can share an identity. They should not share a password in Slack. Portal compose on paid plans is a third path. SMTP and API share the same From list and the same ceilings. Pick one secret per client.

Failures and the proof that ends arguments

AUTH failure: wrong host, port, TLS pair, username, or password. Or still on Free. Rotate if the secret was pasted into a ticket. Create a new credential instead of “trying variations.”

550 5.7.1 after AUTH: identity not approved, domain not verified, or policy refusal. Creating an inbound alias is not the same as approving outbound. Catch-all is not a From factory.

Green client, empty inbox: you sent to yourself, leftover MX ate the reply, or the destination filtered it. Read history for hops this layer saw. MailerZ cannot show a hop that never reached it.

Limit errors: Solo is 2,500 outgoing per month and 20 per hour. Starter is 5,000 and 40. Business is 12,000 and 60. Agency is 20,000 and 60. Unlimited is 100,000 and 300. Waiting or upgrading is the fix. DNS is not.

Timeouts: firewall, wrong TLS pair, or a VPS that cannot open outbound 587. The form plugin’s green check can be a connection that never finished. Log the exception, not the thank-you page.

“Via” and spam at the destination are receiving-side stories. Authenticated SMTP did its job if the hop shows accepted. Alignment and reputation are separate. Do not rewrite Header From to “look cleaner.” MailerZ will not do that for you on inbound, and you should not do it on outbound to dodge a filter.

MailerZ workflow and product boundary

MailerZ provides authenticated SMTP for verified domain identities on paid plans. You copy what the desk at mail.mailerz.net shows. You do not get a published inbox-placement SLA. You do not get IMAP. Mail Box is the portal view of incoming, held, forwarded, and outgoing mail. It is not a Gmail replacement. The mailbox page is the product surface. This article does not restate it.

Free: one domain, ten aliases, one seat, 14-day store, unknown mail hold or reject, send-as off, SMTP off, API off. Every paid plan includes unknown mail Forward, send-as On, SMTP On, and API Enabled. Solo $40/year: 5 domains, 25 aliases, 2,500 outgoing, 20/hour. Starter $8/$80: 8 / 50 / 5,000 / 40. Business $19/$190: 25 / 200 / 12,000 / 60. Agency $39/$390: 100 / 500 / 20,000 / 60. Unlimited $99/$990: uncapped domains and aliases, 180-day store, 100,000 outgoing, 300/hour. Confirm on /pricing. Limits are not an SLA.

Store windows are recovery for hops this layer saw. Fourteen days on Free. Ninety on Solo through Agency. One hundred eighty on Unlimited. That is not an archive and not legal hold.

Human send-as from Gmail is the attach flow on send and reply. Forms, crons, and apps use the same credential class. Docs keep the current field labels. Use those pages when you need clicks. Use this page when you need the model.

What this guide is not

It is not a ranked list of SMTP vendors. “Best SMTP” pages exist to collect affiliates. If you need a campaign sender, compare ESPs on complaint handling and consent, not on who used the word relay in a headline.

It is not a Mail Box tutorial. Opening held mail, blocking a sender domain, and portal compose belong on /mailbox. Mixing those screens into an SMTP guide makes both pages worse.

It is not the Gmail Send mail as runbook. Google changes labels. /docs and Google’s help article own that path. If you came here for screenshots of a Gmail dialog, leave with the order of operations and open those pages next.

It is not a promise that AUTH plus green DNS puts mail in Primary. Receiving systems decide. MailerZ will not sell you a badge that says otherwise.

Plans, ceilings, and when to buy something else

Solo at $40 per year is the usual first send-as plan for one domain and a quiet form. Starter raises the month and the hour if the site is noisy. Business and Agency exist for more domains and aliases, not for newsletters. Unlimited is capacity, still not a campaign product.

Buy a transactional ESP when receipts and password resets are the product and volume is the business. Buy Google Workspace or Microsoft 365 when you need Calendar, admin, and a hosted store. Buy MailerZ SMTP when you already read Gmail or Outlook and you need a domain From you can revoke.

Suite SMTP is correct if policy requires the tenant to be the sender. Do not point a plugin at MailerZ and Microsoft for the same From without knowing which identity is approved where. Two signers on one From is how DMARC reports get ugly.

Time is part of cost. An afternoon on leftover MX usually exceeds Solo. A leaked Gmail password in wp-config usually exceeds Agency.

Worked cases

Founder: Gmail plus hello@

Inbound is already on MailerZ. The founder still replies as the Gmail string. Customers write back to the Gmail address and the domain slowly dies. Authenticated SMTP custom domain sending is the missing attach. Upgrade. Create one credential. Follow Google’s Send mail as dialog. Set From to hello@. Probe from a second provider. Keep Free only if you are still proving inbound and you can wait to send.

Do not use the Gmail password as the SMTP password. Google will lock the account. MailerZ will never have needed that secret.

Agency: one WordPress form per client

The agency used one Gmail SMTP in every client plugin. Headers print the agency. Google eventually blocks it. Split credentials. One secret per zone. From equals that client’s hello@ or forms@. Revoke on offboard. Delete MX you own. Stop forwarding leftovers into the agency inbox.

Agency plan capacity is 100 domains and 500 aliases. It is not a reason to skip a named list. Catch-all Forward on paid is a dated hose, not an ownership model.

Cron on a VPS

The box used to call sendmail. Reputation is the host IP. Move the job to authenticated SMTP. Store the secret in the environment, not in the repo. Rate limit. A flapping monitor that mails every thirty seconds will hit 20/hour on Solo before lunch. That is the ceiling doing its job. Quiet the monitor or raise the plan. Do not open a ticket asking to “just this once.”

Probe outbound to an address you do not own. Self-send from the VPS to the same Gmail you use for login can short-circuit. Unique subject. Save the SMTP transcript.

Still on Free

The plugin is pointed at MailerZ. AUTH or identity fails. That is correct. Free cannot send-as. Prove inbound first. Then pay. Pointing the plugin here on Free is wasted time.

Operator notes that stay true next quarter

Inventory clients before you rotate a password. Dual-write if the product allows two secrets. Disable the old one after the probe. Friday rotations without a probe are how Monday starts with a silent form.

Never mail the SMTP password to support. Send a timestamp, a Message-ID, and the 550 line. If the secret already leaked, rotate first, then talk.

Do not put card numbers or passwords through a form that uses this hop. Logs and destination stores keep them. AUTH does not make a form a payment page.

CAN-SPAM and GDPR are not solved by SMTP AUTH. Consent, suppression, and legal pages are a different stack. MailerZ is not your counsel.

Nameserver moves reset assumptions. If NS left the registrar, the pretty MX you edited in the registrar UI is theater. Find the authoritative zone first. Then talk about SMTP.

Self-send remains a bad test after you attach SMTP. Gmail can accept a message to itself without proving the public path. Use a second mailbox. The inbound article says the same thing for MX. It is true here too.

If Header From was rewritten by some other forwarder on a different hop, authentication stories get noisier. MailerZ does not rewrite Header From on inbound. Do not add a rewrite on outbound to “match the inbox.”

Unlimited aliases as marketing will not save a missing From list. Three named identities beat a harvest of admin@ guesses. Grow the send list when a real person needs a new public name.

Comparisons after the hop is honest: Cloudflare routing is inbound. A privacy-mask product hides a destination on a provider domain. A suite hosts mailboxes. An ESP sends campaigns. MailerZ is the delivery layer when you already have an inbox and you need a domain route you can prove. Cite the other product’s docs. Do not invent parity.

Review quarterly, or sooner after a nameserver move, a plugin swap, a staff departure, or a pricing change. The credential you forgot is the one that still works for a contractor who left.

A second pass: write the last change on a note before you open the dashboard. Nameserver move, leftover MX, new plugin, contractor laptop, registrar forwarding toggle. History only shows hops that reached this layer. If the note says leftover MX, you do not have an SMTP mystery.

A third pass: print the public From list. If you cannot print it, you are not ready for production send-as. Unlimited as a plan name is capacity. It is not a substitute for the list.

FAQ

What is authenticated SMTP for a custom domain?

It is a username, password, host, and TLS pair that lets a client submit mail as a From you already verified. The server checks the credential and the identity, then accepts or returns 550. It is not an open relay and not a mailbox login.

Does MailerZ Free include send-as SMTP?

No. Free is one domain, ten aliases, one seat, a 14-day store, unknown mail hold or reject, and send-as / SMTP / API off. Paid plans turn those three send paths on. Confirm numbers on /pricing.

Is this the same as Gmail or Outlook mailbox SMTP?

No. Mailbox SMTP is the login for a hosted store. MailerZ SMTP is a delivery-layer credential for a verified domain identity. You still read mail in Gmail, Outlook, or Mail Box. You do not get IMAP or POP.

Why do I get SMTP 550 after AUTH succeeds?

Authentication proved the secret. Authorization failed the From, the plan, or the recipient policy. Free cannot send-as. An identity you never created is not approved. Unhosted or unauthorized recipients are refused. Copy the 550 text. Do not hunt for an open relay.

Do I still need SPF, DKIM, and DMARC?

Yes if you send as the domain. Authenticated SMTP is the hop. Those records tell receiving systems who may use the domain. Publish what the dashboard instructs. Green checks are not an inbox-placement promise.

Can I paste a Gmail password into a form plugin?

No. Use the MailerZ credential the dashboard shows, or Google’s own send path if you are sending as a Gmail address. A founder Gmail password in WordPress is a lockout waiting to happen.

Key takeaways

• MX receives. Authenticated SMTP sends. They are not the same cut.
• Free has no send-as. 550 on Free is correct.
• Copy host, port, and TLS as one pair.
• From must be an identity you created. Catch-all is not a From.
• Never put a Gmail password in a plugin.
• Hourly and monthly ceilings both apply. They are not an SLA.
• Leftover MX breaks replies, not AUTH.
• This is not IMAP, not a campaign ESP, and not a ranked vendor list.

Conclusion and next action

Authenticated SMTP for a custom domain is a paid, identity-scoped hop. Prove inbound. Pay. Copy the dashboard. Probe outward. Log 550 instead of hunting for a public relay.

Next action: if hello@ does not yet receive from the outside, start there. If inbound is honest and you still reply as a Gmail string, attach send-as on a paid plan. Use /docs for the current client fields. Use /troubleshooting if leftover MX is still public.

If a plugin already holds a founder password, rotate that password this week. Then point the plugin at a generated credential.

Review quarterly, or sooner if provider behavior, pricing, or MailerZ scope changes. Author: MailerZ editorial, Secuno LLC.