Knowledge base
Send email through your own SMTP server
Connect your own SMTP server: which port to use and why not 25, the SPF, DKIM, DMARC and reverse-DNS records you have to publish yourself, and why we refuse to fall back to an unencrypted connection.
Use this if you run your own mail infrastructure, or if your provider is one we do not list directly — almost every mail service offers SMTP.
⚠️ If your provider is Mailgun, SendGrid, Postmark, Amazon SES or Resend, use its own guide instead. Those connections give you better error messages when something goes wrong, because we can read what the provider actually said rather than an SMTP status code.
What you need
Four things, from whoever runs your mail server:
- Host — e.g.
smtp.yourprovider.com - Port —
587,465or2525 - Username and password
Which port
587 is submission with STARTTLS and is what you should use. The connection starts in the clear and is upgraded to TLS before anything is sent.
465 is implicit TLS — encrypted from the first byte. Equally fine; some providers prefer it.
2525 is an unofficial alternative that some hosts offer because a few networks block 587. Use it only if your provider tells you to.
⛔ Port 25 is accepted here but is almost never the right answer. It is the port mail servers use to talk to each other, not the one an application uses to submit a message. It is blocked on most networks, it frequently has no authentication, and where it does work it is often unencrypted.
⛔⛔ We will not send over an unencrypted connection. If you leave Use STARTTLS on — and you should — and your server refuses to upgrade, the send fails rather than continuing in the clear. That is deliberate: your clients' password-reset links travel in these messages, and a downgrade nobody notices is the worst kind of failure, because the mail still arrives.
Set your DNS up first
Your provider does not do this for you the way a managed service does. You need, on the domain you are sending from:
SPF — a TXT record authorising your server's address: v=spf1 ip4:203.0.113.10 -all, or v=spf1 a:smtp.yourprovider.com -all. If you already have an SPF record, edit it; two SPF records on one domain fail SPF entirely.
DKIM — your mail server signs outgoing messages and you publish the matching public key at <selector>._domainkey.yourdomain.com. On Postfix this is usually OpenDKIM; your provider will tell you the selector.
DMARC — a TXT record at _dmarc.yourdomain.com, starting at v=DMARC1; p=none; while you check that SPF and DKIM both pass.
Reverse DNS — the PTR record for your server's IP address should resolve back to its hostname. Large receivers check this and many will not accept mail from an address without it. Your hosting provider sets it, not your DNS provider.
⭐ A good free check once you have it running: send a message to mail-tester.com and read the score. It tells you which of the four is wrong, which is much faster than guessing from a spam folder.
Connect it in Zinn®
Open Email sending in your dashboard:
- Provider — SMTP server
- Send from this domain —
mail.yourdomain.com(a domain, not an address) - SMTP host, Port, Username, Password
- Use STARTTLS — on, unless you are on port 465
⭐ Create a dedicated mailbox or submission user for this, rather than reusing a person's login. When somebody leaves and their password changes, your clients' notifications should not stop.
Send the test and enter the code
Press Send test message to an inbox on a different domain, read the code out of it, and enter it.
When it does not work
"The mail server rejected the username or password" — SMTP AUTH failed. If your provider has two-factor authentication on the account, you almost certainly need an app password rather than the login password.
"Could not reach host:port" — the port is blocked, the hostname is wrong, or the server is not listening for submission on that port. telnet smtp.yourprovider.com 587 from another machine will tell you which.
A TLS error — your server's certificate is expired, self-signed, or does not match the hostname you entered. We verify certificates and will not skip that check; fix the certificate.
"The mail server refused the recipient" — your server is not configured to relay for this sender, which usually means the authenticated user is not permitted to send as your sending domain.
It sends but everything lands in spam — that is DNS, not SMTP. Work through SPF, DKIM, DMARC and reverse DNS above, then re-run the mail-tester check.
Still stuck?
Support is included on every plan and answers in your own language.
Contact support → All articles →