Any issue if PHP mail() mail server not MX of FROM domain?

Question

Suppose I have this scenario:

My mail server (and thus MX) for my email address me@company.com is hosted in my office.

My website company.com is hosted by third party web hosting company.

On my website I created a <form> with FROM, TO, SUBJECT, BODY and send out using PHP mail() to customers.

Since the web server is third party, PHP mail() uses localhost mail server.

I think that my mails will reach the customer's mail server and appear as "forged" or spam.

What do I need to do to ensure my mails appear legitimate and incoming mails will not be sent to the third party web host?

Answer 1

Your messages will be subject to the policies of the receiving domains - the only people who can tell you "What [you] need to do to ensure your mails appear legitimate" are the mail admins at those sites.

Some suggestions:

1. Ensure that your mail form is reasonably secure - You don't want to inadvertently become a spammer.
2. Make sure your FROM and REPLY-TO addresses point to the places you want bounces/replies/etc. to go
3. Make sure that your web server is listed in your domain's SPF record
4. Properly configure DKIM, if you so desire.
5. If you will be sending bulk mail speak to the postmaster/bulk mail folks at the larger sites (Yahoo, Google, Hotmail, etc.)
6. (Optionally) Configure your web server to use your normal MX as a Smart Host/Relay.

Answer 2

You should add a SPF Sender Policy Framework record to your domain. The SPF record is a txt file added to your domain that specifies who is allowed to send email for that domain. In this case, you'd add your web server.

Here's an example: example.com. TXT "v=spf1 a:mail.example.com -all"
This record says that only mail.example.com is allowed to send mail for the domain example.com.

Most of the big public email companies have guidelines for bulk mail. Here's AOL's. Follow their guidelines to ensure best delivery.

Check if your webserver is on an email blacklist here. Blacklists are by IP, so you may have gotten one without knowing it. I once setup a VoIP server for a client, who then wanted voicemail indications to be emailed out. It's at this point we discovered that his IP was on an email blacklist, and we had to get a new IP for the server.

Answer 3

Since the webserver will be the one sending the mails, its reputation is what determines how the mail is handled by the recipient. Things like blacklists, correct reverse DNS, SPF, Domainkeys, etc. all play a part in this decision. I don't think MX records are taken into account. It depends entirely on the recipient's mailserver, and you can only follow the best practices for mailservers.

Instead I would suggest relaying all these outgoing mails via a dedicated mailserver. It's much easier to ensure a good reputation for a single mailserver, especially once you have multiple webservers that you don't fully control.

If you have control over the mailsoftware on the webserver you should set it to relay via your own mailserver. Don't forget to configure your own mailserver to allow relaying from those webserver IP's. If you don't control the mailsoftware you can configure PHP's mail() command to submit mail directly to your mailserver.

You could also use a service that is dedicated to these kinds of transactional mails. They will take care of reputation, bounces, blacklists, etc. for you. Email delivery is hard work, and some companies specialize in it. They provide you with several options, such as an SMTP relay or an API to send directly from PHP with advanced delivery tracking, unsubscribe support, etc.

sendgrid.com is the one that we use, but other popular ones are postmarkapp.com or authsmtp.com. Rackspace provides a free SendGrid account up to 40k emails per month. Amazon has their Simple Email Service with a free tier for their hosting customers. Ask your hosting-provider if they offer smtp relay, or if they have a special offer with one of these companies.