How PHPMailer Sends an Email

A successful contact form involves more than calling $mail->send(). PHP must load PHPMailer, connect to the selected SMTP server, negotiate encryption, authenticate, submit the sender and recipients, transfer the message and receive an SMTP acceptance response. The receiving mail system then decides whether to deliver, quarantine, reject or place the message in spam.

This creates several different meanings of “email not working.” A class loading failure happens before any network connection. A timeout occurs before authentication. A 535 error usually appears during authentication. A sender rejection happens after connection and often after authentication. A message that PHPMailer successfully submits but never reaches the inbox is usually a delivery or filtering problem, rather than the same problem as an SMTP connection failure.

PHPMailer Installation and Autoloading Errors

The recommended PHPMailer installation method is Composer. Composer installs the package and generates an autoloader that resolves the PHPMailer classes and their dependencies.

composer require phpmailer/phpmailer

The PHP file then loads the project autoloader:

require __DIR__ . "/vendor/autoload.php";

use PHPMailer\PHPMailer\Exception;
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;

The relative path depends on where the executing PHP file is located. Using __DIR__ prevents the path from changing merely because the script was called from another working directory.

A manual installation requires the relevant source files and matching namespace imports. Copying one PHPMailer file from an old tutorial while using current namespace syntax can produce class-loading errors. Filename capitalization can also appear to work on Windows and fail on case-sensitive hosting.

Match the SMTP Port and Encryption Mode

A TLS “wrong version number” error frequently points to a disagreement between the port and connection mode. Disabling certificate validation may hide a local certificate problem but should not be treated as the permanent fix.

SMTP Connection Errors Are Not Password Errors

Authentication happens only after a network connection is established. When the transcript stops while opening the connection, changing the mailbox password is unlikely to solve the first failure.

Gmail Password and App-Password Errors

A normal Google account password may be rejected by an SMTP integration. Where an app password is available and appropriate, it requires 2-Step Verification and is separate from the normal account password. Some work, school, security-key-only or Advanced Protection configurations may not offer app passwords.

An app password should be stored like any other secret. It should not be placed in frontend JavaScript, published source code, screenshots or a public debugging report. Changing the Google account password may revoke existing app passwords, requiring a newly generated credential.

Use the Authenticated Mailbox as the Sender

A common contact-form mistake is using the visitor’s submitted address as the message’s From address. The SMTP provider may reject that sender, rewrite it or accept a message that later fails SPF or DMARC alignment.

Use the authenticated or verified mailbox as From:

$mail->setFrom(
    "website@example.com",
    "Website Contact Form"
);

Place the validated visitor address in Reply-To:

$mail->addReplyTo(
    $visitorEmail,
    $visitorName
);

This preserves the ability to reply to the visitor while keeping the actual sender aligned with the account authorized to transmit the message.

send() Success Does Not Guarantee Inbox Delivery

A successful PHPMailer send normally means that the SMTP server accepted the submitted message. It does not promise that the final recipient placed it in the inbox. The message may be delayed, quarantined, rejected later, bounced or classified as spam.

For accepted but missing messages, inspect:

• The spam, junk, quarantine and promotions folders.
• The provider’s activity or delivery log.
• Delayed bounce or rejection messages.
• The exact recipient spelling.
• Whether a different recipient provider receives the message.
• SPF, DKIM and DMARC configuration for a custom domain.
• Sender reputation and sending volume.
• Message content, links, attachments and misleading subject text.

The first test should be a small plain-text message with no attachment, shortened link or complex HTML. Add features one at a time after basic delivery is confirmed.

Why PHP mail() Can Return True Without Delivery

PHP’s mail() return value indicates whether the message was accepted for handing off to the configured local mail system. It does not prove final recipient delivery. XAMPP on a normal local Windows machine does not automatically become a trusted internet mail server.

PHPMailer using authenticated SMTP is often easier to diagnose because it provides connection, encryption, authentication and server-response information. Simply changing from PHPMailer to mail() may remove useful evidence without solving deliverability.

Use SMTP Debug Output Safely

PHPMailer debug output can show where the conversation stops. Level 2 is often enough to see client and server messages, while level 3 adds connection information. Low-level debugging should be temporary.

Do not display an SMTP transcript to public contact-form users. It can reveal hostnames, account identifiers, message metadata and operational details. Capture it privately during development and remove or disable it afterward.

Prevent Contact-Form Email Abuse

A public email form can be abused as a spam relay even when SMTP itself is configured correctly. The server must control the recipient, sender, subject structure and message format.

• Keep the destination recipient fixed on the server.
• Validate the visitor name and email.
• Limit message length.
• Reject header-breaking characters in short fields.
• Use CSRF protection where applicable.
• Add rate limiting and bot controls.
• Do not let visitors specify arbitrary CC or BCC recipients.
• Escape visitor content when building an HTML body.
• Log abuse signals without logging SMTP secrets.

Safe PHPMailer Debugging Order

1. Confirm PHPMailer loads without a class or autoload error.
2. Confirm OpenSSL is available for encrypted SMTP.
3. Verify the SMTP hostname, port and encryption combination.
4. Test outbound connectivity from the environment running PHP.
5. Enable temporary sanitized SMTP debugging.
6. Determine whether failure occurs before or after authentication.
7. Verify the SMTP username and credential type.
8. Use the authenticated or verified mailbox as From.
9. Send a minimal message without HTML or attachments.
10. Check send result, ErrorInfo and caught exceptions.
11. Inspect spam, bounces and provider delivery logs.
12. Disable debug output and protect the public form.

Continue Your CodeZips Project Workflow

Technical References

• PHPMailer Official Repository and Examples
• PHPMailer Troubleshooting Guide
• PHP Manual: mail()
• PHP Manual: filter_var()
• Google Account Help: App Passwords