Drupal sends email for password resets, user registrations, contact forms, order updates, workflow alerts, moderation notifications, and custom business processes. On a production site, those messages should not depend on the web server's local mail() function. They should go through the company's approved email server or SMTP relay.

Using the company SMTP service gives Drupal a controlled delivery path: authentication, TLS encryption, sender policy, logging, rate limits, compliance controls, and better deliverability through SPF, DKIM, and DMARC.

Why Use SMTP Instead Of PHP mail()

Drupal core can send mail through PHP's default mail handling, but that is rarely enough for production. Local server mail often lacks authentication, centralized logs, bounce handling, reputation management, or alignment with the company's domain policy.

SMTP gives you:

• Authenticated sending.
• TLS encryption between Drupal and the mail server.
• Centralized mail logs.
• Company-approved sender identities.
• Rate limiting and abuse controls.
• Better alignment with SPF, DKIM, and DMARC.
• Clearer troubleshooting when mail fails.

Choose The Drupal Mail Module

For a straightforward SMTP setup, the SMTP Authentication Support module is a common choice. Drupal.org describes it as a module that lets Drupal bypass PHP mail() and send directly to an SMTP server using SMTP authentication and SSL/TLS support through PHPMailer.

composer require 'drupal/smtp:^1.4'
drush en smtp -y
drush cr

For richer email needs, consider Mailer Plus, previously known as Symfony Mailer. Drupal.org describes it as a mail system based on Symfony Mailer with support for HTML mail, attachments, embedded images, third-party delivery integrations, failover, signing/encryption, async sending, and more.

composer require 'drupal/symfony_mailer:^2.0'
drush en symfony_mailer -y
drush cr

If your immediate goal is simply “send Drupal mail through the company SMTP server,” start with SMTP Authentication Support. If your roadmap includes templated HTML messages, queues, attachments, or more advanced delivery policies, evaluate Mailer Plus.

Collect SMTP Details From The Email Team

Do not guess these settings. Ask the company email or infrastructure team for the exact values.

Configure SMTP Authentication Support

After enabling the module, go to the SMTP configuration page in Drupal. The route can vary slightly by version, but it is usually under:

/admin/config/system/smtp

Typical values:

• SMTP server: smtp.company.com
• SMTP port: 587
• Encrypted protocol: TLS/STARTTLS
• Username: service account or SMTP username
• Password: stored securely, not committed to Git
• From address: company-approved sender
• From name: site or product name

Send a test email from the module's test interface if available. Then test a real Drupal flow such as password reset or contact form submission.

Store Credentials Safely

SMTP credentials are production secrets. Do not commit them in exported Drupal configuration, YAML files, deployment scripts, or screenshots.

Safer patterns:

• Use environment variables and override config in settings.php.
• Use a secrets manager provided by your hosting platform.
• Use different credentials per environment.
• Rotate credentials when team access changes.
• Restrict SMTP accounts to only the domains and sender addresses Drupal needs.

A settings override can look like this:

$config['smtp.settings']['smtp_host'] = getenv('SMTP_HOST');
$config['smtp.settings']['smtp_port'] = getenv('SMTP_PORT') ?: 587;
$config['smtp.settings']['smtp_username'] = getenv('SMTP_USERNAME');
$config['smtp.settings']['smtp_password'] = getenv('SMTP_PASSWORD');

The exact config keys depend on the module version. Export configuration after setup, inspect the YAML, and override the sensitive values only.

Deliverability: SPF, DKIM, And DMARC

A successful SMTP connection does not guarantee inbox delivery. Receiving mail servers look at domain alignment and sender reputation.

• SPF: DNS record listing systems allowed to send mail for the domain.
• DKIM: cryptographic signature added by the mail server.
• DMARC: policy that tells receivers what to do when SPF/DKIM alignment fails.
• Bounces: failed deliveries should route to a monitored mailbox or processing system.

Ask the email team to confirm that the SMTP relay signs mail correctly and that Drupal's From address aligns with company policy.

Hosting And Network Considerations

Many hosting providers block outbound SMTP by default to prevent abuse. Before blaming Drupal, confirm network access:

nc -vz smtp.company.com 587
openssl s_client -starttls smtp -connect smtp.company.com:587

If those fail from the Drupal hosting environment, ask the hosting provider or network team whether outbound SMTP is allowed. For cloud-hosted Drupal, the recommended path may be an internal relay, a corporate mail gateway, or an API-based service rather than direct SMTP.

Testing Checklist

Test more than the module's “send test email” button.

• Send a module test email.
• Request a password reset email.
• Submit a contact form.
• Trigger any custom workflow notifications.
• Check Drupal watchdog logs.
• Check SMTP server logs.
• Check spam/quarantine folders.
• Validate SPF, DKIM, and DMARC alignment from a received message.
• Confirm bounces go somewhere monitored.

Troubleshooting Common Problems

Connection Timed Out

The Drupal server cannot reach the SMTP host and port. Check firewall rules, hosting provider outbound restrictions, VPN/private network requirements, and DNS resolution.

Authentication Failed

The username/password may be wrong, the account may require app-specific passwords, SMTP AUTH may be disabled, or the account may not be allowed to relay from the Drupal hosting network.

TLS Or Certificate Error

The encryption mode may be wrong. Port 587 usually uses STARTTLS; port 465 usually uses implicit SSL/TLS. Also confirm the SMTP certificate chain is trusted by the container or server running Drupal.

Email Sends But Goes To Spam

Check SPF, DKIM, DMARC, From alignment, sending domain reputation, message content, and whether Drupal is using an unauthorized sender address.

Some Messages Send, Others Fail

Look for rate limits, attachment size limits, blocked recipient domains, invalid From addresses, and custom modules sending mail with unexpected headers.

Production Checklist

• Use SMTP or a supported mailer module instead of local PHP mail.
• Confirm host, port, encryption, username, sender, and relay rules with the email team.
• Store credentials outside Git.
• Use environment-specific credentials.
• Confirm outbound network access from the Drupal hosting environment.
• Test password resets, contact forms, and custom notifications.
• Check SPF, DKIM, and DMARC alignment.
• Route bounces and failures to a monitored mailbox.
• Document rotation and incident response steps.
• Monitor mail logs after deployment.

Reference Links

• SMTP Authentication Support module on Drupal.org
• Mailer Plus/Symfony Mailer module on Drupal.org

Final Takeaway

Setting up SMTP in Drupal is not just filling in a host and password. It is an agreement between Drupal, the hosting network, the company email server, DNS authentication, and the teams that monitor delivery.

Start by collecting exact SMTP settings, configure Drupal with a supported mailer module, keep credentials out of Git, test real Drupal mail flows, and verify deliverability with SPF, DKIM, and DMARC. Once that path is stable, Drupal email becomes predictable instead of mysterious.