Email & SMTP

Order confirmations, password resets and vendor invites all depend on email. A working SMTP connection is not enough; the domain also needs authentication and a monitored reply address.

SMTP or API?

Option	Use when	Notes
SMTP	Any provider; simplest setup	Host, port, encryption, username, password
Provider API	High volume or better tracking	Requires a plugin or custom integration
Local mail	Development only	Almost always lands in spam in production

Configure the sender domain

Create a subdomain such as mail.yourdomain.com for transactional email.
Add the provider's SPF record and DKIM keys.
Publish a DMARC record; start with p=none and a reporting address.
Set the From address to a real mailbox you monitor, and Reply-To to support.
Warm up gradually if the domain is new.

Test checklist

Password reset to Gmail, Outlook and a local provider.
Order confirmation with an image and a tracking link.
Vendor invite and payout statement.
Refund and cancellation messages.
Spam score and link check.
Unsubscribe link for marketing mail, not transactional mail.

Common failures

Symptom	Check
Connection refused/timeout	Host, port, TLS mode, firewall, provider allowlist
Authentication failed	Username, app password, API key, 2FA on the mailbox
Mail lands in spam	SPF, DKIM, DMARC, domain reputation, content
Images broken	Absolute HTTPS URLs, public storage, hotlink protection
Mail queues but never sends	Cron/queue worker, provider rate limit, disk full

Do not use a personal Gmail SMTP account. It has low limits, weak deliverability and ties the business to an individual mailbox. Use a transactional provider or your domain's SMTP service.