PHP emails can easily spoof the From header and are often rejected. The likelihood here is that your receivers mail server is rejecting it as potentially unsafe.
Note that just because the email left your server, does not mean that the recipients mail server is happy to receive it. Often a mail server will respond with Status: OK even though it has no intentions of passing it along to the recipients mailbox.
There are a couple things you could try:
- Ensure your
From is a valid email address.
- DKIM can significantly help with validating that the email has come from a valid location
- SPF can help validate that the email has come from the location it says it did.
- Modify the X-Mailer header, some MX servers treat PHPMailer as untrustworthy. See here: https://phpmailer.github.io/PHPMailer/classes/PHPMailer.PHPMailer.PHPMailer.html#property_XMailer
DKIM
DKIM requires you to have a TXT DNS record on the domain you are sending from using a public/private key you generate yourself:
Note that the DNS record should be using the public key
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4lox7LckG2/QtT/IY677O2JTgzh3z/FKKqGSVjAk6Gh+7Tyu8jjFUmPdLj/G5u9cFGkQvqa[..]QJZOGgxBeFv2V/Evk9GZtF+3yiHm5tZvi0Z4xhT17dt8ZxcFZ3QIDAQAB
The TXT DNS record should have a name of: whoeveryouare._domainkey.mydomain.com
You can then sign your emails using PHPMailer like so:
// must match the domain in the "From"
$this->DKIM_domain = "mydomain.com"
// private key path
$this->DKIM_private = "/path/to/dkim/private.key";
// dns selector (this matches with TXT record with hostname: whoeveryouare._domainkey.mydomain.com)
$this->DKIM_selector = 'whoeveryouare';
// private key passphrase (has none)
$this->DKIM_passphrase = '';
//Suppress listing signed header fields in signature, defaults to true for debugging purpose
$this->DKIM_copyHeaderFields = true; // SHOULD BE FALSE IN PRODUCTION
// who is signing this email
$this->DKIM_identity = $this->From;
Using DKIM can suppress emails saying that they were "sent on behalf of" and improve your chances of the recipients mail server accepting your email.
SPF
SPF stands for Sender Policy Framework.
Sender Policy Framework (SPF) is an email authentication method designed to detect forging sender addresses during the delivery of the email
SPF helps ensure that the Sender (the From address), actually came from where it says it did. An SPF record looks like the below
v=spf1 +ip4:192.168.3.4 -all
Where 192.168.3.4 is the IP address of the server sending the email.
I personally extend PHPMailer and do all of this on the fly:
/**
* Class Mailer
*
* A wrapper class for the PHPMailer package
*/
class Mailer extends \PHPMailer\PHPMailer\PHPMailer
{
/**
* PHPMailer constructor.
*
* Automatically configure SMTP credentials and adjust X-Mailer header
*
* @param null $exceptions
*/
public function __construct($exceptions = null)
{
parent::__construct($exceptions);
$this->XMailer = "My Super Cool Platform";
}
/**
* Automatically signs emails with a DKIM signature if enabled
*
* @return bool
* @throws \PHPMailer\PHPMailer\Exception
*/
public function send()
{
// must match the domain in the "From"
$this->DKIM_domain = "mydomain.com"
// private key path
$this->DKIM_private = "/path/to/dkim/private.key";
// dns selector (this matches with TXT record with hostname: whoeveryouare._domainkey.mydomain.com)
$this->DKIM_selector = 'whoeveryouare';
// private key passphrase (has none)
$this->DKIM_passphrase = '';
//Suppress listing signed header fields in signature, defaults to true for debugging purpose
$this->DKIM_copyHeaderFields = true; // SHOULD BE FALSE IN PRODUCTION
// who is signing this email
$this->DKIM_identity = $this->From;
return parent::send();
}
}
Email is and always will be a tedious thing to deal with, you can counter a lot of the issues you would face by using an SMTP server to send your emails with DKIM/SPF as a significant bonus.
