Tutorial

How to send email when SMTP is blocked

Free hosts block outbound mail. Here is why, and how to send contact form mail properly with an HTTP email API instead.

Ben Johnson · last checked 2026-09-21 · 4 min read

You are on free shared hosting. SMTP is blocked. That means port 25 is closed and PHP’s mail() function does nothing. Your contact form probably fails without telling you. This page explains why that block exists and what to do instead.

Why the block exists

One spammer ruins it for everyone. If a single account on a shared server sends bulk spam, the IP address of that server ends up on blocklists. Every other site on that server then finds their email rejected by Gmail, Outlook, and Yahoo. It can take weeks to get the IP removed.

Free hosting is especially vulnerable. There is no payment method to deter abuse, so spammers open accounts, send junk until they are caught, then open another. Closing port 25 is the only way to keep the shared IP clean. This is why our acceptable use policy bans outbound SMTP entirely.

The block is not subtle. PHP’s mail() call will appear to succeed — it returns true — but the message never leaves the server. You might see a 500 Internal Server Error if your code tries to connect to an SMTP server directly. Either way, the email is gone.

The fix over HTTPS

The solution is an HTTP email API. These services accept your email as an HTTPS request over port 443 — the same port your browser uses to load this page. Because port 443 is always open, the request gets through.

The flow looks like this:

1. Your contact form submits to your site.
2. Your PHP script builds the email and sends it to the API over HTTPS.
3. The API delivers the email to the recipient’s inbox.

You do not need SMTP credentials. You do not need to open any ports. You just need an API key and a few lines of code.

Which API to choose

There are several providers. The important thing is that they accept requests over HTTPS and handle delivery for you. Most have a free tier that covers a few hundred emails per day, which is enough for a contact form.

The setup is always similar:

• Sign up for an account with the provider.
• Get an API key.
• Add their PHP library or use cURL to send the request.
• Replace your mail() call with the API call.

The WordPress case

If you run a WordPress site, the fix is even simpler. Install a plugin that uses an HTTP email API. Many WordPress SMTP plugins can be configured to use an API instead of an actual SMTP server. Our WordPress guide covers the plugin setup in detail.

DNS records you must add

This is the part people skip. Even if your email leaves the server correctly, it will land in spam if your domain lacks proper authentication records.

SPF (Sender Policy Framework) tells receiving servers which IPs are allowed to send mail for your domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature that proves the email was not tampered with.

Your HTTP email provider will give you the exact SPF and DKIM records to add to your DNS. You need to add them in your domain’s DNS management panel. Our email DNS checker can verify that the records are set correctly after you add them.

Without these records, Gmail and Outlook treat your email as suspicious. With them, your messages are far more likely to reach the inbox — though no setup can promise it every time.

What else is blocked

SMTP is not the only thing missing on free hosting. You also do not get:

• Cron jobs (scheduled tasks)
• SSH access
• Node.js, Python, Ruby, or Go
• Backups of any kind
• An uptime guarantee

If you need any of those, you need paid hosting from another provider. CWP does not sell a paid plan. There is no upgrade path.

The honest economics of the block

Free hosting costs money to run. Every server, every IP address, every rack in the data centre has a monthly cost. Spam multiplies that cost because it gets the IP blocklisted, which means you cannot send legitimate email either.

Closing port 25 is not a technical limitation. It is an economic decision. The cost of dealing with spam is higher than the value of the few contact forms that actually need to send mail. The HTTP API approach shifts the delivery cost to a provider whose business model is built around handling that cost.

This is why the block exists and why it will not be removed. The API fix is not a workaround. It is the intended solution.

When the email still fails

If you have set up the API and added SPF and DKIM but email still does not arrive, check these things:

• Is your API key correct? A typo in the key will give a 401 error.
• Is the API endpoint correct? Some providers have different URLs for test and production.
• Are you sending to an address you control? Test with an address you can check, not a customer’s.
• Did you check the spam folder? Even with DKIM, some filters are aggressive.

If the API call itself fails, check your PHP error logs. The API response will usually contain a message explaining the problem.