I'm sorry if this has been asked but I'm not quite sure how to search for it. I'm having a bit of trouble understanding how mail() works in PHP. The way I see it, using that function, I can send e-mails from any user on my mail server - existent or not, without needing any credentials or anything. I doubt the guys from PHP would let this be the way I think it is and I also suspect that this has something to do with the fact that e-mails I send from my mail server go straight into the spam folders on other mailing services (gmail, yahoo etc.)

Can somebody shed some light on me and fill the missing link. Thanks!

  • 1
    Because the specifications for email as a whole allow it. There's no authentication in email addresses.
    – GordonM
    Jan 8, 2015 at 9:18

2 Answers 2


Unfortunately, this is just how email works. There is no way for PHP to validate whether you are allowed to send mail from a particular address, so it will let you specify any address you want. Your mail server may be configured to reject email from invalid mailboxes, or if you do not have the correct authentication details for a valid mailbox, but most servers are not set up to do this.

As to why your email is being rejected by the large service providers, the most likely cause is that either you are on a blacklist somewhere, you're sending email directly from an end-user ip address without using a relay server, or have not correctly implemented sender address verification for your domain.

  • 1
    I am infact hosting my server from my home computer but why is that considered spam? I may be fully legitimate business owner with this setup?
    – php_nub_qq
    Jan 6, 2015 at 10:39
  • 3
    Based on probability: the vast majority of spam is sent from botnets that use malware-infected home pcs as their hosts. Very few legitimate businesses use an end-user connection to host a mail server because (a) they're unreliable and (b) most ISPs provide a perfectly good relay server for their clients to use.
    – Jules
    Jan 6, 2015 at 10:43
  • Makes sense, but I went for the end-user version because I didn't want my emails to be kept on my ISP's server. Too bad I can't have the best of both worlds :( Thanks for clearing this out!
    – php_nub_qq
    Jan 6, 2015 at 10:48
  • 1
    To extend @Jules' last point, the two major verification methods that Gmail et al use to figure out if something is spam are SPF and DKIM, essentially two DNS records you can add to your domain that say "these servers are allowed to send mail from @example.com". Email service Mandrill has a good overview of what they are and there are various guides on setting them up depending on where your domain is registered. Jan 7, 2015 at 10:32

PHP, like most software, is supposed to help you do things, not put restrictions in your way. It isn't the job of the PHP team to restrict what you can do. The PHP team couldn't take on that job if they wanted to, since if someone wanted to get around the restrictions they could just choose some competing less restrictive software to build their application on instead of PHP.

Restricting what you can do with email is up to the administrators of the systems that you send email from, via and too, not the software you use yourself. PHP allows you to attempt to send mail with any From: address you choose, but the system you are trying to deliver it to can still block it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.