Website contact form SMTP is authenticated send as a domain identity you already receive on. Pay for send-as. Put the host, port, username, and password the dashboard shows into the form plugin. Do not paste a Gmail password into WordPress. Do not use an unauthenticated relay. MailerZ Free has no send-as. Unauthorized send is 550.
Quick answer for website contact form smtp
The safest website contact form SMTP setup is: domain verified, inbound proven, leftover MX gone, paid plan, one SMTP credential, From equal to an approved identity such as hello@yourdomain, and a destination inbox you already read. The form submits. The app authenticates. MailerZ accepts or returns 550. You read the message in Gmail or Outlook.
Authenticated SMTP is the hop. Send as custom domain is the From the visitor should see if you also notify them — though most forms only notify you. SMTP relay in the mailbox-host sense is the wrong mental model if you still live in Gmail. You want a delivery-layer credential, not a hosted mailbox login.
PHP mail(), registrar “forward this form,” and a personal Gmail SMTP with a real password are the three common failures. The first burns the host IP. The second hides leftover MX. The third violates Google’s rules and your sleep. Use an app password only if you are sending through Google as Google. If you are sending as your domain through MailerZ, use MailerZ’s credential.
Inbound still matters. If hello@ does not receive from the outside, do not celebrate that the form sent. Visitors who reply to an auto-response will hit the same MX. Prove both directions when the form uses a domain From.
MailerZ Free is one domain, ten aliases, one seat, a 14-day store, send-as disabled, SMTP and API disabled, and unrouted mail held or rejected only. Solo is $40 per year only. Starter is $8 monthly or $80 yearly. Business is $19 or $190. Agency is $39 or $390. Unlimited is $99/month or $990/year. Confirm numbers on MailerZ pricing. Limits are not an inbox-placement promise.
authenticated smtp: the real decision
Developers want the form live before DNS is honest. The plugin shows a green check. Customers write to hello@ printed on the same page and vanish into leftover Google MX. The form and the printed address are one product. Treat them as one cutover.
Marketing installs three form tools, each with its own SMTP. You now have three secrets and three From lines. Pick one identity. Revoke the rest.
Agencies copy a Gmail address into every client form because it “just works.” It works until Google blocks it. It also prints the agency Gmail to anyone who views headers.
Criteria: which From, which credential, which monthly send ceiling, where failures go, and who can rotate the secret. If you cannot rotate, you do not have a setup.
| Path | From the visitor sees on notify | Risk |
|---|---|---|
| Paid MailerZ SMTP, approved identity | hello@yourdomain | Plan limits; 550 if wrong |
| Gmail SMTP with the founder password | The Gmail string | Lockouts, policy, leaked secret |
| PHP mail() on the web host | Whatever the host stamps | Shared-IP reputation |
| Unpaid MailerZ Free | Cannot send-as | Do not point the plugin here |
Prove the hop on one domain before you print a new address on a invoice or a form.
Start free — one domainTechnical mail flow for website contact form smtp
The web app connects to the SMTP host you copied, upgrades or starts TLS as the dashboard pair requires, authenticates, and offers MAIL FROM plus a From header. MailerZ checks the credential and the approved identity. Success queues the message. Failure should be a 5xx you log, not a silent thank-you page.
If the notify address is your Gmail, the message is outbound from MailerZ to Google as a normal delivery. That is not forwarding. That is send. SPF and DKIM for the domain must match what you publish. DMARC follows the domain you claimed in From.
If you also auto-reply to the visitor, you are sending as the domain to a stranger. Stay inside hourly and monthly limits. This is not a campaign tool. Burst form spam can look like a burst campaign. Rate limit the form at the app.
STARTTLS versus implicit TLS is a pair with the port. Copy the dashboard. Mixing them fails before a body exists. Unauthorized identities fail after AUTH with 550 5.7.1.
Transport still follows IETF RFC 5321 — Simple Mail Transfer Protocol. Envelope commands are not the header block people see. MailerZ may rewrite only the envelope return path with Sender Rewriting Scheme. MailerZ is a product of Secuno LLC. It is inbound MX plus authenticated SMTP. Envelope SRS only. Header From, Subject, Date, Message-ID, body, and MIME are never rewritten. It is not Google Workspace, not IMAP, and not an open relay. Unhosted or unauthorized send is SMTP 550 / 550 5.7.1. Leftover MX is a hard stop. Self-send from Gmail to the same Gmail account can hide routing errors. Probe from another mailbox. MailerZ is not SOC 2, not ISO 27001, and not HIPAA.
send as custom domain: step-by-step setup
Do the inbound cut first. A form that can send while hello@ is still on leftover MX is a half-migrated site.
- Verify the domain. Create hello@ or forms@. Map a destination. Publish one MX set. Delete leftover MX. Probe from another mailbox.
- Upgrade off Free. Solo is the smallest send-as plan at $40 per year. Confirm /pricing.
- Create one SMTP credential. Store it in the host secret manager, not in a ticket.
- Set the plugin host, port, encryption, username, and password exactly as shown. Set From to the approved identity.
- Submit the form to a unique subject. Confirm the destination inbox and delivery history. Confirm the visible From.
- Rate limit the form. Log SMTP replies. Do not retry forever on 550.
- Revoke the credential when the contractor leaves or the plugin is replaced.
- Re-test after any DNS or plugin update. Self-send tests are not enough.
Client clicks for Gmail live in Google Gmail Help — Send mail from a different address. Outlook uses a manual SMTP identity when you also send as the domain. Incoming mail stays at the destination mailbox.
Failure modes and proof
550 5.7.1: identity not approved or still on Free. Do not “fix” by switching to an open relay.
Green plugin, empty inbox: leftover MX on inbound replies, or the notify address filtered. Read history.
Timeouts: wrong port or TLS pair. Copy the dashboard. See STARTTLS versus TLS if you already published that article.
Form spam filling the monthly ceiling: the form is the bug. Auth SMTP is doing its job.
Gmail password in wp-config. Rotate the Google account. Move to MailerZ SMTP.
Use a public MX view before you cut. Leftover hosts split mail even when the new record looks correct in one resolver.
Open leftover MX troubleshootingMailerZ workflow and product boundary
MailerZ provides authenticated SMTP for verified domain identities on paid plans. It is not transactional-email at campaign scale. Hourly and monthly send-as limits are published on /pricing. Free has no send-as, SMTP, or API.
Use /send-reply and /docs for the client attach steps when a human also sends as the same identity from Gmail. The form and the human can share an identity. They should not share a password in Slack.
Not an open relay. Not IMAP. Not SOC 2. Failed hops can sit in the recovery window. Fourteen days Free, ninety paid.
Related pages: send and reply, docs, features. Those routes exist on this site. Do not invent a second MX religion beside them.
smtp relay
Solo at $40 per year is the usual form budget for a single domain. Starter raises send ceilings if the site is noisy. A dedicated transactional vendor is the right buy when receipts and password resets are the product, not a contact form.
Suite SMTP is correct if the mailbox host is already Microsoft 365 and policy requires it. Do not mix that with MailerZ From until you know which identity is approved where.
The cheap-looking path — mail() — is the expensive reputation path.
MailerZ Free is one domain, ten aliases, one seat, a 14-day store, send-as disabled, SMTP and API disabled, and unrouted mail held or rejected only. Solo is $40 per year only. Starter is $8 monthly or $80 yearly. Business is $19 or $190. Agency is $39 or $390. Unlimited is $99/month or $990/year. Confirm numbers on MailerZ pricing. Limits are not an inbox-placement promise. Time is part of cost. An afternoon on leftover MX usually costs more than Solo.
Put a unique Message-ID friendly subject on tests so you can find the hop. “Test” is how tickets die.
If the form sends to multiple staff, that is destination fan-out after send, or multiple RCPT. Prefer one inbox and a ticket.
Legal pages still matter. A form that sends is not consent architecture. CAN-SPAM and GDPR are not solved by SMTP AUTH.
Do not send passwords or card numbers through the form. SMTP logs and destination stores will keep them longer than you think.
Field notes you can reuse
Worked example: WordPress plus leftover Google MX
The plugin shows a green check. The form arrives in the founder Gmail because the notify address is that Gmail. hello@ on the same page still dies at leftover Google MX. Visitors who reply to an auto-response vanish. Website contact form smtp is not done when the plugin is green. Inbound on the printed address is part of the same product.
Cut MX. Probe hello@ from another mailbox. Then keep the plugin on paid MailerZ SMTP with From=hello@. If you are still on Free, the plugin should not be pointed here. Solo is the usual first send-as plan. Confirm pricing.
Rate limit submissions. A scraped form will burn the monthly send ceiling and look like a campaign. MailerZ is not a bulk sender. The form app must defend itself.
Secrets
Store the SMTP password in the host secret manager. Do not put it in a ticket, a screenshot, or a group chat. When the freelancer leaves, revoke. A new credential is cheaper than explaining a leaked From to a customer.
Never paste the Gmail password into the CMS. That path locks the founder out and prints the Gmail identity. Authenticated smtp through MailerZ is a different pair. Send as custom domain is the From. Smtp relay in a mailbox-host article is a third mental model. Pick one.
Log the SMTP reply. A silent thank-you page with a 550 behind it is how leads disappear. 550 5.7.1 means unauthorized. Fix identity or plan. Do not hunt for an open relay.
What not to send
Forms that collect passwords or card numbers turn your SMTP logs and the destination store into a vault you did not want. Do not do that. CAN-SPAM and GDPR are not solved by AUTH. Legal pages still exist on this site.
If the site needs receipts and password resets at volume, buy a transactional vendor built for that. A contact form on Solo is a different job. Mixing them on one identity without rate limits is how you hit 25 send-as per hour on Agency and still feel blocked.
Operator brief
A longer operator brief for website contact form smtp
Teams that bookmark How to Send Website Contact Form Email Through Authenticated SMTP usually arrive after a missed invoice, a form that never notified anyone, or a migration that looked clean in one resolver. The useful brief is still boring. Name the store. Name the printed local-parts. Name the nameservers that actually answer. Publish one MailerZ MX set. Delete leftover hosts. Probe from a mailbox that is not the destination. Only then talk about website contact form smtp as a send-as, catch-all, or comparison problem.
MailerZ remains inbound MX plus authenticated SMTP around Gmail or Outlook. Envelope SRS only. Header From, Subject, Date, Message-ID, body, and MIME stay intact. It is Mail Box portal webmail, not IMAP, not POP, and not an open relay. Unauthorized send is 550 / 550 5.7.1. Free cannot finish send-as: SMTP and API stay off. Solo is $40 per year when the domain From must travel. Starter is $8 or $80. Business is $19 or $190. Agency is $39 or $390. Unlimited is $99/month or $990/year. Confirm the live pricing page. Those numbers are ceilings, not an inbox-placement service-level agreement.
If leftover Google, Microsoft, Cloudflare routing, or registrar MX is still public, stop widening website contact form smtp. The map you built never saw that copy. Priority numbers are an order, not load balancing. A higher preference host is idle while a leftover host still accepts mail. Save the old MX set before you delete anything. Check more than one public view because TTL lies.
Catch-all forward is not a safety feature for how to send website contact form email through authenticated smtp. Hold unknowns on everyday production. Review the store. Promote a leftover only when a real person used it. Paid forward belongs to a dated cutover. Fan-out of unknowns into two inboxes trains two spam buttons. Plus addressing on Gmail is not a custom-domain unknown policy. MailerZ will not strip plus tags on your domain the way Gmail does on @gmail.com.
Send-as is a second hop. Creating an inbound alias does not approve outbound. Catch-all does not mint a From. Copy the dashboard host, port, and TLS pair together. Set From to an identity you created. Do not paste a Gmail password into a CMS, a cron file, or a ticket. Do not mail SMTP secrets to support. Send a 550 line, a timestamp, and a Message-ID. Rotate if a secret already leaked.
Self-send from Gmail to the same Gmail account can short-circuit. That green result is why people swear website contact form smtp works while customers vanish. Use a second provider. Put a unique subject on the probe so delivery history is searchable. If Header From was rewritten by some other forwarder, authentication stories get noisier. MailerZ does not rewrite Header From on inbound.
Agencies should keep website contact form smtp per client zone. Separate SMTP credentials. Do not pour every client into one catch-all because the spreadsheet got long. Agency plan capacity exists so you can hold more domains and aliases. It does not replace a named list. Offboard means delete MX you own, revoke SMTP, and stop forwarding leftovers into the agency inbox.
Legal and security questions have published answers on the security, privacy, terms, DPA, and subprocessors pages. MailerZ is not SOC 2, not ISO 27001, and not HIPAA. The 14-day Free store, the 90-day Solo–Agency store, and the 180-day Unlimited store are recovery windows for hops this layer saw. They are not an archive and not legal hold. If counsel wants eDiscovery, buy eDiscovery.
Comparisons only help after the hop is honest. Cloudflare Email Routing is inbound routing. A privacy-mask product hides a destination on a provider domain. A suite hosts mailboxes, Calendar, and admin. Proton-class mailboxes encrypt a store. MailerZ is the delivery layer when you already have Gmail or Outlook and you need a domain route you can prove. Cite the other product’s documentation. Do not invent feature parity.
When How to Send Website Contact Form Email Through Authenticated SMTP is closed, the next physical action is a lookup and a probe, not another tab. Start free on one domain you can break. Sign in if the zone already lives here. Review quarterly, or sooner after a nameserver move, a plugin swap, or a staff departure. That is how website contact form smtp stays a runbook instead of an incident.
A second worked pass for website contact form smtp: write the last change on a sticky note before you open the dashboard. Nameserver move, leftover MX, new form plugin, contractor laptop, or a registrar forwarding toggle are the usual five. MailerZ history only shows hops that reached this layer. If the sticky note says leftover MX, you do not have a website contact form smtp mystery. You have a split. Delete the leftover. Wait for TTL. Probe again.
A third worked pass: print the public list. If you cannot print it, you are not ready for production unknowns and you are not ready for a bigger alias ceiling. Unlimited aliases as marketing will not save a missing list. Three named aliases on Free are enough to stop printing a personal Gmail on a homepage. Grow the list when a real person used a leftover, not when a harvest guessed admin@.
FAQ
- What is the safest way to handle website contact form smtp?
- Verify the domain, prove inbound, delete leftover MX, upgrade to a paid plan, create one MailerZ SMTP credential, set From to an approved identity, and rate limit the form. Do not use Gmail passwords or PHP mail().
- Does this require a new mailbox?
- No. The form is a send client. Staff still read Gmail or Outlook.
- Will it work with Gmail or Outlook?
- The notify message lands in those inboxes as ordinary mail. Humans who also send as the domain use Gmail Send mail as or Outlook SMTP on the same paid identity.
- What DNS records are involved?
- MX and verification for inbound. SPF, DKIM, and DMARC for the domain From. Leftover MX still breaks replies.
- What should I test before production?
- Submit the form with a unique subject. Confirm From, destination, and delivery history. Confirm a bad password fails closed. Confirm inbound to the printed address.
Key takeaways
- Paid send-as before the plugin goes live.
- Never put a Gmail password in the CMS.
- From must be an approved identity.
- Prove inbound MX on the same domain.
- 550 means unauthorized, not “try a public relay.”
- Rate limit the form.
- Revoke credentials at handover.
- MailerZ is not a bulk sender.
Conclusion and next action
Point the contact form at authenticated SMTP on a domain you already receive. Cut leftover MX. Pay for send-as. Log failures. Revoke secrets.
Next action: prove hello@ inbound, upgrade, create one credential, submit a uniquely titled form. Start free only for the inbound half.
If the site already sends, rotate whatever password is in the plugin this week.
Forms need paid send-as
Start free to prove inbound, then pay before the form sends.
Cut leftover MX. Probe hello@. Create one SMTP credential. Point the plugin at that hop.
Review quarterly, or sooner if provider behavior, pricing, or MailerZ scope changes. Author: MailerZ editorial, Secuno LLC.