When developers should use SMTP vs an email API

Quick answer

Pick SMTP when Gmail Send mail as, Outlook, WordPress, or a cron job already knows MAIL FROM and DATA. Pick the MailerZ API when your service wants HTTPS and JSON more than a socket. Pick an ESP API when you have a list, templates at marketing volume, or unsubscribe law as the product. MailerZ is inbound MX plus authenticated outbound on paid plans. Envelope SRS on inbound. Header From, Subject, Date, Message-ID, body, and MIME stay intact on the forward hop.

Free is one domain, ten aliases, one seat, a 14-day store, send-as Off, SMTP Off, API Off. Every paid plan turns send-as, SMTP, and API on inside published limits. Solo is $40 per year: 2,500 outgoing, 20 per hour. Starter is $8 or $80: 5,000 and 40. Business is $19 or $190: 12,000 and 60. Agency is $39 or $390: 20,000 and 60. Unlimited is $99 or $990: 100,000 and 300, 180-day store. Confirm MailerZ pricing. Limits are not an inbox SLA.

Transport still follows IETF RFC 5321 — Simple Mail Transfer Protocol. Gmail’s attach steps live in Google Gmail Help — Send mail from a different address. Authentication still follows IETF RFC 7208 — Sender Policy Framework (SPF), IETF RFC 6376 — DomainKeys Identified Mail (DKIM), and IETF RFC 7489 — Domain-based Message Authentication, Reporting, and Conformance (DMARC).

The real decision

Developers reach for an API because HTTP feels modern, then spend a week rewriting a WordPress plugin that only speaks SMTP. Other developers paste SMTP into a serverless function that already has an HTTP client and then fight idle timeouts. The useful question is: what client exists today, and is the stream operational or a list?

Two outbound hops

SMTP is a conversation: EHLO, AUTH, MAIL FROM, RCPT TO, DATA. The dashboard gives you host, port, TLS mode, username, and password as one pair. MailerZ checks the From identity, the plan, and the caps. Unauthorized or unhosted recipients get 550 / 550 5.7.1. That is the open-relay guard, not a bug.

The API is HTTP sending on paid plans. Same From rules. Same outgoing counters. Same store window for hops this layer saw. Copy values from the dashboard. Do not invent paths from a SendGrid tutorial. Portal compose is a third outbound door on paid plans. All three share the cap.

Inbound is still MX. If customers reply to hello@, exclusive MailerZ MX and a named alias decide whether you see it. SMTP versus API does not fix leftover Google MX. A pretty outbound integration and a split inbound path can both be true.

Header From on inbound stays the stranger. Outbound Header From must be an identity you created. Catch-all does not mint a From. Creating an inbound alias does not approve the API or SMTP. Self-send from Gmail to Gmail can hide both outbound and inbound tests.

Step-by-step choice

1. Name the stream

   Password reset, invoice, contact form, or a list. If it is a list, stop and buy an ESP. MailerZ is not a campaign sender.

2. Prove inbound if replies matter

   Exclusive MX. Leftovers gone. Unique subject from another mailbox. Help on troubleshooting.

3. Leave Free

   SMTP and API stay off until you pay. Solo at $40 per year is the smallest door. Confirm pricing.

4. Create the From identity

   Named alias. Set From to that string. Do not invent noreply@ unless you created it.

5. Pick the client that already exists

   Wizard or plugin → SMTP pair. HTTP service → API values from the dashboard. Copy TLS with the host. Do not mix last year’s ESP secret with this month’s host.

6. Send to a third mailbox

   Unique subject. Open original. Confirm Header From. Read history. Put secrets in env, not in the repo, not in a ticket.

Related: send and reply, features, docs. Gmail’s labels are in Google Gmail Help — Send mail from a different address.

Failure modes and proof

MailerZ workflow and product boundary

Paid MailerZ includes portal compose, SMTP, and API sending. They share outgoing counters and From policy. Mail Box at the app host shows incoming, held, forwarded, and outgoing hops inside the store window. That is not IMAP and not a Gmail replacement. This article does not change the mailbox UI.

MailerZ is not a campaign sender, not an open relay, not an inbox SLA. Unauthorized send is 550. Agencies: one credential per client. Do not share SMTP or API tokens across the book.

Cost and alternatives

SMTP versus API does not change the invoice. The plan does. Stay on Free while inbound is the question. Pay when outbound must travel. Confirm pricing the day you enable either hop. Time spent rewriting a working SMTP plugin into HTTP is usually more expensive than Solo.

ESP APIs (the SendGrid-class vendors) are correct for lists. Cite their docs. Nofollow commercial pages. Registrar SMTP and web-host mail() are reputation gifts to strangers. Cloudflare Email Routing is inbound. It does not become MailerZ SMTP because a function mentioned email.

Worked examples

They rewrote WordPress to “use the API”

The plugin already had SMTP fields. They spent a sprint inventing HTTP. They pasted the dashboard SMTP pair, proved Header From on a third mailbox, and deleted the sprint. The client was SMTP. The fashion was the bug.

Serverless plus an idle SMTP socket

Cold starts and long EHLO waits looked like AUTH failure. They switched that function to the paid API values from the dashboard, kept the same From, and left WordPress on SMTP. Two clients, one cap.

The list that 550’d at hour twenty-one

They used Solo as a newsletter. Twenty per hour is a stop sign. They bought an ESP. MailerZ kept password resets. Two streams, two vendors. Honest.

API green, replies missing

Outbound Header From was correct. Inbound still hit leftover Microsoft MX. They deleted the leftover, probed hello@, and left the API alone. The hop they rewrote was not the hop that was broken.

Write the stream on a sticky note: form, reset, invoice, or list. If it says list, stop. If it says form, SMTP is usually enough. If it says reset in a service that already has an HTTP client, the API is enough. If it says leftover MX, fix inbound before you pick a client.

Secrets belong in env. Rotate if a secret sat in git or a ticket. Send support a 550 line, a timestamp, and a Message-ID. Do not mail the password or the API token. Do not put a Gmail password in the MailerZ form.

Rate-limit the app. A contact form that retries on 4xx can become your hourly cap. Honor 550 as stop. Honor 4xx as later, once. Do not loop. Caps are published so you can design for them.

Self-send still lies. Prove outbound on a mailbox that is not the dest. Prove inbound from a provider that is not Gmail if Gmail is the dest. Unique subjects. Open original.

Quarterly review: leftover MX, env rotation, and whether a stream became a list. Review sooner after a plugin swap or a staff departure. When this page is closed, the next physical action is a dashboard copy and a probe, not another framework debate.

Libraries, sockets, and what “already speaks SMTP” means

A WordPress plugin with SMTP fields already speaks SMTP. So does Gmail Send mail as, Outlook’s SMTP identity, Magento’s mail transport, a Laravel mailer pointed at smtp, and a cron that shells out to a client that opens 587. Those tools want a host, port, TLS mode, username, and password. Copy that pair from the MailerZ dashboard on a paid plan. Do not invent a REST wrapper so the stack looks modern. The From identity, the hourly cap, and the 550 guard do not care which fashion you picked.

A backend that already posts JSON to other vendors, runs on a short-lived function, and has no durable socket is a better API candidate. Cold starts plus EHLO plus AUTH plus DATA can look like a flake when the real problem is idle time. For that process, copy the paid API values from the dashboard. Same From. Same counters. Same store window for hops this layer saw. Do not paste a SendGrid path into MailerZ. Do not paste a MailerZ token into a SendGrid SDK.

Portal compose is a third outbound door on paid plans. It shares the cap with SMTP and the API. A human who clicks send in the app and a cron that AUTH’s the same hour can meet the hourly stop together. Design for that. Solo is 20 per hour. Starter is 40. Business and Agency are 60. Unlimited is 300. Confirm pricing. Those numbers are stop signs, not a negotiation after a launch email.

Staging, secrets, and two environments

Staging should not share production SMTP or API secrets. A leaked staging token that can send as hello@ is a production incident. Prefer a separate From identity for staging, or keep staging on a mailbox you do not print. Put secrets in env. Rotate if a secret sat in git, a ticket, or a screenshot. Send support a 550 line, a timestamp, and a Message-ID. Do not mail the password. Do not put a Gmail password in the MailerZ form. Two hops, two credentials.

AUTH 535 is almost always a mixed pair: last year’s host with this month’s password, or a username copied from another vendor. Recopy the live dashboard values. TLS mode belongs with the host. STARTTLS on 587 is not “the API.” A function that talks HTTPS to the API does not need an SMTP port. Mixing them is how people file tickets that say “the API AUTH failed” when they opened a socket.

Inbound still owns replies

Customers who reply to hello@ are judged by exclusive MX and a named alias, not by whether you used SMTP or HTTP to send the first message. Leftover Google or Microsoft MX will hide replies while outbound Header From looks perfect. Print public MX from two views. Delete leftovers. Probe from another mailbox with a unique subject. Help on troubleshooting. Related: send and reply.

Header From on inbound stays the stranger. Envelope SRS may rewrite the return path so the next hop can pass SPF. MailerZ does not rewrite Header From on the forward hop. Outbound Header From must be an identity you created. Catch-all does not mint a From. Creating an inbound alias does not approve SMTP or the API. Free still has send-as Off, SMTP Off, and API Off. Pay first.

Retries, 4xx, and the hourly cap

A contact form that retries on every 4xx can become your hourly cap before lunch. Honor 550 as stop. Honor a temporary 4xx as later, once, with backoff. Do not loop. Do not treat a monthly 550 after a good week as “switch to the API.” The API shares the same monthly counter. If the stream is a list, buy an ESP. MailerZ is not a campaign sender. Cite the ESP’s docs. Nofollow commercial pages.

Self-send from the dest Gmail to hello@ that lands in the same Gmail can hide both outbound and inbound. Prove outbound on a third mailbox. Prove inbound from a provider that is not the dest. Open original. Confirm Header From. Search spam. Classify is dest policy. Neither SMTP nor the API files Primary. Limits are not an inbox SLA.

Agencies and one token per client

One agency SMTP pair across ten client From identities is how one laptop becomes every brand. Create identities per zone. Rotate at handover. Delete MX you own when the engagement ends. Seats are dashboard operators, not dest inboxes. Two developers on one client still share that client’s pair only if both must send. Prefer env per repo, not a Slack paste. Unauthorized send is 550. That is the open-relay guard, not a bug to work around with a second vendor.

Legal pages are published separately. MailerZ is not SOC 2, not ISO 27001, not HIPAA. An API flag is not a compliance badge. If counsel wants eDiscovery, buy eDiscovery. The store window — 14 days on Free, 90 on paid, 180 on Unlimited — keeps hops this layer saw. It is not Vault. Mail Box at the app host shows incoming, held, forwarded, and outgoing inside that window. This article does not change that UI. MailerZ is not IMAP and not a Gmail replacement.

Frameworks people actually hook up

Laravel, Rails, Django, Magento, and most WordPress SMTP plugins want a host and a password. That is SMTP. A Next.js route or a Cloudflare Worker that already posts JSON is an API candidate. GitHub Actions can go either way; prefer the client the action already documents. Do not add an SMTP library to a Worker just to say you used SMTP. Do not add an HTTP client to Magento just to say you used an API. Copy dashboard values. Prove Header From on a third mailbox. Stay inside the hourly cap.

PHP mail() on the web host is neither hop. It sends as the server and usually fails SPF for your domain. Registrar “SMTP” with no history is a thin gift to strangers. Cloudflare Email Routing is inbound. It does not become MailerZ SMTP because a function mentioned email. If replies matter, exclusive MX still owns the return path after you pick a client. Write the stream on a sticky note again after launch. If it became a list, stop and buy an ESP.

When SMTP and the API both fire

A form plugin that already sends SMTP plus a webhook that posts the same event to the API will send twice. Recipients see two copies with two Message-IDs. Caps count both. Pick one client per event. If you migrate a plugin to the API, disable the SMTP transport in the same deploy. If you keep WordPress on SMTP, do not also post that submission from a Worker.

Idempotency is your job. MailerZ will accept two authorized submissions as two messages. A unique subject in staging is how you notice the double before customers do. Confirm MailerZ pricing only if you are still on Free — a double send is not a reason to buy a larger cap. Fix the two clients first.

FAQ

When should a developer use SMTP instead of an email API?

Use SMTP when the client already speaks it: Gmail Send mail as, Outlook, WordPress, cron, or a language library that opens port 587. Use MailerZ’s paid API when the app already speaks HTTP and you do not want an SMTP client. Use a bulk ESP API when the stream is a list. Do not force one to be the other.

Does MailerZ include both SMTP and an API?

On every paid plan, SMTP is On and API is Enabled. Free has send-as Off, SMTP Off, and API Off. Copy host, port, TLS, and API values from the dashboard. Do not invent endpoints from a generic tutorial.

Does this require a new mailbox?

No. MailerZ is not IMAP. Keep Gmail or Outlook as the store. SMTP and API are outbound hops for approved From identities, inside published caps.

What should I test before production?

Prove inbound first if replies matter: exclusive MX, unique subject from another mailbox. Then send one operational message through SMTP or the API to a third mailbox. Confirm Header From. Self-send is not proof.

Can I use MailerZ SMTP or API for newsletters?

No. MailerZ is not a campaign sender. Solo is 2,500 outgoing per month and 20 per hour. Unlimited is 100,000 and 300. Caps are stop signs. Buy an ESP for lists.

What DNS is involved?

Verification TXT, exclusive MX for inbound, leftover hosts gone, and SPF, DKIM, and DMARC if you send as the domain. SMTP host and API URLs are not DNS. Copy them from the app.

Key takeaways

• Pick the client that already exists. SMTP for wizards and plugins. API for HTTP-native apps.
• Lists belong on an ESP. MailerZ is not a campaign sender.
• Free: SMTP Off, API Off. Paid: both on, same From rules, same caps.
• Solo $40/year starts outbound. Confirm /pricing.
• Copy dashboard values. Do not invent hosts or API paths.
• Inbound MX is a different hop. Leftover MX is a hard stop.
• Unauthorized send is 550. Caps are stop signs.
• Secrets in env. Third mailbox for proof. Self-send lies.

Conclusion and next action

Use SMTP when the client is SMTP. Use the MailerZ API when the app is HTTP and the stream is operational. Use an ESP when the stream is a list. Pay first. Copy the dashboard. Prove Header From somewhere else. Do not rewrite a working plugin for fashion.

Review quarterly, or sooner if a stream becomes a list or MailerZ caps change. Author: MailerZ editorial, Secuno LLC.