Sending email from your website and applications (SMTP)

A new server usually has no email sending service set up, so messages from contact forms, password resets and cron jobs don't go out. This guide shows how to send them, with authentication, through the SMTP server of your domain's email provider or of a transactional email service, and which DNS records to add. You run the commands on the server, as root, in an SSH session (Connecting to your server over SSH (Windows, macOS, Linux)). The server's IP address is in the app.blackbox.md panel, under “Infrastructure” → “My Servers”, in the “IP” field.

Available to: anyone with root access over SSH to a BLACKBOX server. On a “VPS hosting” plan with a control panel, first ask support which panel is installed: “VPS hosting” plans with a control panel.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

What you need from your email provider

Use the SMTP server of the provider that hosts your domain's email, or a transactional email service. Note down the following from the provider's documentation:

In many applications, STARTTLS (port 587) is labeled “TLS”, and TLS from the start of the connection (port 465) is labeled “SSL”.

Why not send directly from the server's IP address? Receiving servers check the reputation of the sending IP address and its reverse record (PTR), and a new address has no reputation yet. Reverse DNS (PTR) is not set from the panel: send us the server's IP and the name you want. With an SMTP service, messages leave from the provider's servers, which already pass these checks.

Security Anyone who has your SMTP password or API key can send email on behalf of your domain. Don't put it in public git repositories, in screenshots or in support tickets. Give the files that contain it 600 permissions, so that only the owner can read them. If your provider allows it, create a separate user or key just for sending, instead of using your mailbox password.

Step 1. Check the connection to the SMTP server

1. Install the nc utility. Ubuntu and Debian:

   apt update
   apt install -y netcat-openbsd

   AlmaLinux and CentOS Stream:

   dnf install -y nmap-ncat

2. Test the port:

   nc -vz -w 5 SMTP_HOST 587

   A good result contains succeeded (Ubuntu, Debian) or Connected (AlmaLinux, CentOS Stream). timed out or TIMEOUT means the SMTP server didn't respond within 5 seconds.

3. Check the encryption:

   openssl s_client -starttls smtp -connect SMTP_HOST:587 -crlf

   After the certificate, you should see Verify return code: 0 (ok). Then type the lines below, pressing Enter after each one. The response to EHLO must contain a line with AUTH, and QUIT closes the connection.

   EHLO test
   QUIT

For port 465, test with:

nc -vz -w 5 SMTP_HOST 465
openssl s_client -connect SMTP_HOST:465 -crlf

If the test returns timed out or TIMEOUT:

1. Check the operating system's firewall. ufw and firewalld let all outgoing traffic through by default; if you have restricted outgoing traffic, allow the port: Firewall: network filtering and ufw/firewalld on the server.
2. Try the other port (465 instead of 587, or the other way around).
3. If it still doesn't work, send support the server's IP address (SERVER_IP), the port and the SMTP server name: How to contact BLACKBOX support.

Step 2. Configure the application

WordPress

By default, WordPress sends email through PHP's mail() function, which has nothing to send through on a new server. Install an SMTP plugin from the WordPress plugin directory and fill in its settings:

• server: SMTP_HOST;
• port: 587, encryption TLS (STARTTLS); or port 465, encryption SSL;
• authentication turned on, with the username and password or the API key;
• sender address: ADDRESS@DOMAIN.

Then send the test email from the plugin. Installing WordPress: WordPress on LEMP (nginx, MariaDB, PHP).

Other applications and frameworks

Enter the SMTP settings in the application's configuration or in its .env file. Variable names differ from one application to another: use the ones from its documentation. An example:

MAIL_HOST=SMTP_HOST
MAIL_PORT=587
MAIL_ENCRYPTION=tls
MAIL_USERNAME=SMTP_USER
MAIL_PASSWORD=SMTP_PASSWORD
MAIL_FROM_ADDRESS=ADDRESS@DOMAIN

Keep the file with the password out of the git repository (add it to .gitignore), and let only the user the application runs as read it, for example www-data:

chown www-data:www-data /var/www/APP/.env
chmod 600 /var/www/APP/.env

Restart the application so that it reads the new settings.

On AlmaLinux and CentOS Stream, SELinux blocks connections from PHP (including WordPress) to the SMTP server by default. Allow them:

setsebool -P httpd_can_sendmail 1

Step 3. Sending from the server with msmtp (optional)

Cron jobs, PHP's mail() function and programs that call sendmail need a program that passes the messages on. msmtp sends them through your provider's SMTP server, with the same details. It doesn't receive email and doesn't keep a message queue.

Ubuntu and Debian

apt update
apt install msmtp msmtp-mta

• The msmtp-mta package creates the /usr/sbin/sendmail command, which cron and PHP use.
• When asked “Enable AppArmor support?”, keep the default answer, “No”.

Warning If apt says it will remove packages (The following packages will be REMOVED), for example postfix or exim4, answer n. An email program is already running on the server, used by a control panel or by a mail server of your own. Don't replace it with msmtp; ask support instead.

AlmaLinux and CentOS Stream

1. First, check whether the server already has an email program:

   ls -l /usr/sbin/sendmail

   A good result contains “No such file or directory”. If the file exists, an email program is already running on the server, used by a control panel or by a mail server of your own. Don't install msmtp; ask support instead.

2. Install msmtp from the EPEL repository:

   dnf install -y epel-release
   dnf install -y msmtp nano

3. The msmtp package also creates the /usr/sbin/sendmail command, which cron and PHP use. Check:

   readlink -e /usr/sbin/sendmail

   The result must be /usr/bin/msmtp. If the command prints nothing, create the link:

   ln -s /usr/bin/msmtp /usr/sbin/sendmail

The configuration file

1. Create the file:

   nano /etc/msmtprc

2. Paste the content below and replace the values in capitals. Save with Ctrl+O and Enter, then exit with Ctrl+X:

   defaults
   auth           on
   tls            on
   tls_starttls   on
   tls_trust_file /etc/ssl/certs/ca-certificates.crt
   syslog         LOG_MAIL
   
   account        default
   host           SMTP_HOST
   port           587
   from           ADDRESS@DOMAIN
   set_from_header on
   user           SMTP_USER
   password       SMTP_PASSWORD

   Line	What it does
   tls_trust_file	the file with the trusted certificate authorities; on AlmaLinux and CentOS Stream, write /etc/pki/tls/certs/ca-bundle.crt
   port 587 and tls_starttls on	for port 465, write port 465 and tls_starttls off
   from	the sender address; the provider must allow it
   set_from_header on	puts the address from the from line in the “From” header of every message; without it, cron messages go out from root, and some providers reject them
   syslog LOG_MAIL	writes one line to the system log for each message sent

3. Allow only root to read the file:

   chmod 600 /etc/msmtprc

Testing

printf 'Subject: Test\n\nTest' | msmtp RECIPIENT_ADDRESS

If the command prints nothing, the message was handed over to the provider. Check the recipient's mailbox, including the Spam folder. You can see the sending result in the log:

journalctl -t msmtp -n 20

A successful line ends with exitcode=EX_OK. If there is an error, msmtp shows the SMTP server's message: see the “Common problems” table below.

PHP

1. Set PHP-FPM to send through msmtp, then reload it. Ubuntu 24.04 (on another system, replace 8.3 with the installed PHP version, for example 8.2 on Debian 12):

   printf 'sendmail_path = "/usr/bin/msmtp -t"\n' > /etc/php/8.3/fpm/conf.d/99-msmtp.ini
   systemctl reload php8.3-fpm

   AlmaLinux and CentOS Stream:

   printf 'sendmail_path = "/usr/bin/msmtp -t"\n' > /etc/php.d/99-msmtp.ini
   systemctl reload php-fpm

2. PHP runs as www-data (Ubuntu, Debian) or apache (AlmaLinux, CentOS Stream) and cannot read a 600 file owned by root. Give read permission to this user's group. Ubuntu and Debian:

   chown root:www-data /etc/msmtprc
   chmod 640 /etc/msmtprc

   AlmaLinux and CentOS Stream, where SELinux must also allow sending from PHP:

   chown root:apache /etc/msmtprc
   chmod 640 /etc/msmtprc
   setsebool -P httpd_can_sendmail 1

This means any PHP code on the server can read the SMTP details: one more reason to use a separate SMTP user, just for sending.

Cron

Cron sends the output of jobs to the address in the MAILTO variable. Without it, cron sends to the local user (for example root), an address the SMTP server cannot deliver to.

1. Open the crontab:

   crontab -e

2. Add the line below at the top and save:

   MAILTO=RECIPIENT_ADDRESS

Step 4. Add SPF, DKIM and DMARC

Without these TXT records, messages often land in Spam or are rejected. Your email provider gives you the exact values. For what each record does, see the “Good practices for sending email” section of Acceptable use policy: what is not allowed.

• A domain has only one SPF record. If one already exists, add your provider's include: to it; don't create a second one. Add ip4:SERVER_IP only if the server sends email itself, without an SMTP service (for example, a mail server of your own).
• SELECTOR is the name given by the provider. Some providers give the DKIM key as a CNAME record: if its value contains the _ character, add it directly in your DNS provider account, not from the panel.
• Start DMARC with p=none. Switch to quarantine or reject once the reports show that your messages pass the check.

You add the records at your domain's DNS provider. If you have connected Cloudflare or GoDaddy, you can add them from the “DNS” page of the panel (app.blackbox.md/dns): “Add record”, type TXT, the “Name” and “Content” fields, then “Save”. The steps: Managing DNS records from the panel.

After a few minutes, check on the server or on your computer (Linux, macOS):

dig +short TXT DOMAIN
dig +short TXT _dmarc.DOMAIN
dig +short TXT SELECTOR._domainkey.DOMAIN

Each command must show the value you added, in quotes. On Windows, use:

nslookup -type=TXT DOMAIN

If dig is missing on the server, install it. Ubuntu and Debian:

apt install -y dnsutils

AlmaLinux and CentOS Stream:

dnf install -y bind-utils

Check delivery

A mail server of your own

If you want mailboxes on the server, or want to receive email (Postfix and Dovecot, or a control panel's email):

• A mail server on a VPS needs ports (25, 465, 587, 993) that are not open by default in the network filtering. The filtering managed by BLACKBOX leaves ports 22, 80 and 443 and ping open by default; other ports are opened on request, through support (Firewall: network filtering and ufw/firewalld on the server).
• The server sends directly to other mail servers, so the reputation of its IP address and the PTR record matter. Reverse DNS (PTR) is not set from the panel: send us the server's IP and the name you want.
• For mailboxes, a specialized provider is usually simpler: you don't have to manage spam filtering, address reputation and message backups yourself.
• On a “VPS hosting” plan, ask support which control panel is installed: “VPS hosting” plans with a control panel.

Important Ask support before you install a mail server. Include the server's IP address, the order number (BBX-…) and the ports you need.

Rules for sending email

Chapter 2 of the “Termeni și condiții” (Terms and conditions) (blackbox.md/info/terms) prohibits:

• spam “în orice formă” (in any form) sent through BLACKBOX services, as well as spam sent through another provider to advertise resources hosted at BLACKBOX (clause 2.2);
• adding addresses to mailing lists without double opt-in. Proof of consent is kept for as long as the list exists, and bought or rented lists are prohibited (clause 2.3).

Send newsletters and bulk campaigns through a specialized email service, not through the regular SMTP of a mailbox. Details: Acceptable use policy: what is not allowed.

An email queue that keeps growing, or messages you didn't send, may mean that the server or the site has been hacked: Your server was hacked or is under attack: what to do.

Common problems

Frequently asked questions

Can I order mailboxes from BLACKBOX? Not from your account: mailboxes can't be ordered online. Ask support what they can offer you: Products and configurations available on request.

Can the AI assistant set up email sending? Yes, with the run_server_command tool and a token with the “Rulează orice comandă ca root pe serverele mele” (Run any command as root on my servers) permission (servers:exec): Running commands on the server through AI. The SMTP details you give it reach the AI model's provider. Use a separate SMTP user, and change its password if you pasted it into a conversation (Token and AI agent security).

Do I need to configure both the application and msmtp? Not necessarily. If the application has its own SMTP settings (step 2), they are enough. You need msmtp for cron, for PHP's mail() function and for programs that call sendmail. With msmtp set up for PHP, WordPress also sends email without an SMTP plugin.

I moved my site from another provider and the forms no longer send email. Why? At your old host, sending was usually set up by the provider. On your BLACKBOX server, you set it up yourself, with the steps above. About moving your email: Moving a site to a BLACKBOX server.