Integrations

It isn't only copiers. Half your building sends email.

Backup software, the NAS, the accounting package, the alarm system, a WordPress contact form, a script somebody wrote in 2014. All of them stopped working for the same reason, and all of them fix the same way. Here's the exact configuration for each.

The settings Applications Code & scripts Mail servers What not to send

The settings, once

Everything below is the same handful of values in a different box. Your console has your account's exact credentials.

Server	mail.send25.net
Port	587
Encryption	STARTTLSSome software calls this "TLS", or just "yes". It is not the same as SSL/465, which we don't offer.
Authentication	Username and password, from your console
From address	Any address at a domain you've verifiedThe display name is yours to choose — Accounts Payable <billing@yourdomain.com>.

Old equipment that can't do TLS or authentication? That's what port 25 is for. We allow-list your building's IP address instead, so the device needs no credentials at all. Ask us to add your address — it's the standard answer for hardware too old to be updated, and it's why we still run port 25 when most services won't.

Applications

The ones we're asked about most. If yours isn't here, the settings above go in whatever it calls its SMTP page — and we'll happily walk through it with you.

WordPress WP Mail SMTP, FluentSMTP, Post SMTP

WordPress's built-in wp_mail() hands mail to PHP's mail(), which sends straight from your web host — unauthenticated, from an IP with no reputation. It is the single most common reason contact-form mail vanishes. Any SMTP plugin fixes it.

Install WP Mail SMTP (or FluentSMTP — either is fine).
Choose Other SMTP as the mailer.
Enter the settings below and send the plugin's test email.

WP Mail SMTP · Other SMTP

SMTP Host        mail.send25.net
Encryption       TLS            (this means STARTTLS)
SMTP Port        587
Authentication   ON
SMTP Username    (from your console)
SMTP Password    (from your console)
From Email       forms@yourdomain.com
From Name        Your Company Website

Set "Force From Email". Plugins and themes often override the sender with whatever a visitor typed into the form. That address won't be on a domain you've verified, so we'll refuse it — correctly. Forcing the From address fixes it, and put the visitor's address in Reply-To instead, which is where it belongs anyway.

Synology NAS DSM 7

Control Panel → Notification → Email.
Tick Enable email notifications.
Choose Custom SMTP server from the provider list.
Fill in the fields, then Send a test email.

DSM · Notification · Email

SMTP server           mail.send25.net
SMTP port             587
Secure connection     TLS/STARTTLS  (tick)
Requires authentication (tick)
Username / Password   (from your console)
Sender email          nas@yourdomain.com

Do the same under Hyper Backup and Snapshot Replication if you use them — they have their own notification settings and don't inherit this one. A backup job that fails silently is worse than one that fails loudly.

Veeam Backup & Replication

Main menu → Options → Notifications → Email Settings.
Tick Enable email notifications.
Add the SMTP server, then Advanced for the port and TLS.
Use Test Message before saving.

Veeam · Email Settings

SMTP server      mail.send25.net
Port             587
Connect using    STARTTLS  (or "Use secure connection")
Authentication   (tick) — username + password from your console
From             backup@yourdomain.com
To               whoever should read it

Backup alerts are exactly the mail you cannot afford to lose to a spam folder. Once it's working, publish the DNS records if you haven't — an authenticated, DKIM-signed backup report lands in the inbox; an unsigned one from a random IP often doesn't.

UniFi Network Controller and UniFi OS

Settings → System → Notifications (older versions: Settings → Email Server).
Choose Custom SMTP.

UniFi · SMTP

Host              mail.send25.net
Port              587
Enable SSL        OFF          (587 uses STARTTLS, not SSL)
Enable Auth       ON
Username/Password (from your console)
Sender address    unifi@yourdomain.com

"Enable SSL" off is correct and counter-intuitive. That checkbox means implicit SSL on port 465. Port 587 upgrades to encryption with STARTTLS after connecting — the traffic is still encrypted. Ticking SSL with port 587 is the usual cause of a hang here.

Home Assistant

Add to configuration.yaml and restart:

configuration.yaml

notify:
  - name: send25
    platform: smtp
    server: mail.send25.net
    port: 587
    timeout: 15
    encryption: starttls
    username: !secret send25_user
    password: !secret send25_pass
    sender: ha@yourdomain.com
    recipient:
      - you@yourdomain.com
    sender_name: Home Assistant

Grafana, Jira, GitLab and similar self-hosted tools

Nearly all of these expose the same five settings. Grafana's grafana.ini is representative:

grafana.ini

[smtp]
enabled = true
host = mail.send25.net:587
user = (from your console)
password = (from your console)
startTLS_policy = MandatoryStartTLS
from_address = grafana@yourdomain.com
from_name = Grafana

Where a tool offers "SSL/TLS" and "STARTTLS" as separate options, pick STARTTLS. Choosing SSL on port 587 makes the connection hang rather than fail cleanly, which is why it's such a time-waster to diagnose.

Accounting and line-of-business software Sage, QuickBooks, ERP systems

These vary far too much for us to give you exact menu paths without guessing, and a wrong instruction wastes more of your time than none at all. What's consistent is what they ask for:

Server / host	mail.send25.net
Port	587
Security / encryption	TLS or STARTTLS — not SSL
Authentication	On, with your console credentials
From / reply address	An address at your verified domain

Look for a menu called Email Setup, Email Defaults, SMTP or Send Options. If the software only offers "Outlook" or "Webmail" as choices, look for an Other / Custom SMTP option — it's usually there but not first in the list.

Tell us what you're running and we'll work it out with you. Invoices going out from the accounting package is usually the reason people call us in the first place, and it's the one worth getting right.

Code and scripts

Working examples. Put the credentials in your environment or a secrets store, not in the file.

PowerShell Windows

PowerShell

$cred = Get-Credential          # or build from a secret store
Send-MailMessage `
  -SmtpServer mail.send25.net `
  -Port 587 `
  -UseSsl `
  -Credential $cred `
  -From    "alerts@yourdomain.com" `
  -To      "you@yourdomain.com" `
  -Subject "Nightly job finished" `
  -Body    "All good."

-UseSsl means STARTTLS here, despite the name. With port 587 it does the right thing.

Microsoft has deprecated Send-MailMessage. It still works and is fine for internal scripts, but it gets no fixes. For anything new, use MailKit — and don't be surprised when the cmdlet eventually disappears.

Python

Python 3

import os, smtplib
from email.message import EmailMessage

msg = EmailMessage()
msg["From"]    = "Alerts <alerts@yourdomain.com>"
msg["To"]      = "you@yourdomain.com"
msg["Subject"] = "Nightly job finished"
msg.set_content("All good.")

with smtplib.SMTP("mail.send25.net", 587, timeout=30) as s:
    s.starttls()                      # required on 587
    s.login(os.environ["SEND25_USER"], os.environ["SEND25_PASS"])
    s.send_message(msg)

Always pass a timeout. Without one, a network blip leaves the script hanging indefinitely — which, in a cron job, means it silently never runs again.

PHP PHPMailer

PHP · PHPMailer

$mail = new PHPMailer\PHPMailer\PHPMailer(true);
$mail->isSMTP();
$mail->Host       = 'mail.send25.net';
$mail->Port       = 587;
$mail->SMTPSecure = PHPMailer\PHPMailer\PHPMailer::ENCRYPTION_STARTTLS;
$mail->SMTPAuth   = true;
$mail->Username   = getenv('SEND25_USER');
$mail->Password   = getenv('SEND25_PASS');

$mail->setFrom('forms@yourdomain.com', 'Your Company');
$mail->addAddress('you@yourdomain.com');
$mail->Subject = 'Website enquiry';
$mail->Body    = 'Someone filled in the form.';
$mail->send();

Don't use PHP's built-in mail(). It hands the message to the local sendmail with no authentication, from your web host's shared IP. That is the exact problem you're here to solve.

Node.js Nodemailer

Node · Nodemailer

import nodemailer from "nodemailer";

const transport = nodemailer.createTransport({
  host: "mail.send25.net",
  port: 587,
  secure: false,               // false = STARTTLS on 587. NOT "no encryption".
  requireTLS: true,            // refuse to send if STARTTLS fails
  auth: { user: process.env.SEND25_USER, pass: process.env.SEND25_PASS },
});

await transport.sendMail({
  from: '"Alerts" <alerts@yourdomain.com>',
  to: "you@yourdomain.com",
  subject: "Nightly job finished",
  text: "All good.",
});

secure: false is correct and badly named. It means "don't start in implicit TLS" — the connection still upgrades via STARTTLS. Adding requireTLS: true makes that mandatory, so it errors instead of quietly sending in the clear.

Bash / cron msmtp

The tidiest way to give a Linux box outbound mail without running a mail server.

~/.msmtprc · chmod 600

defaults
auth           on
tls            on
tls_starttls   on
logfile        ~/.msmtp.log

account        send25
host           mail.send25.net
port           587
from           server@yourdomain.com
user           (from your console)
password       (from your console)

account default : send25

Then:

Terminal

echo "Backup finished" | msmtp -s "Nightly backup" you@yourdomain.com

chmod 600 ~/.msmtprc or msmtp refuses to run. That's deliberate — the file holds a password in plain text. If several users need it, use /etc/msmtprc with appropriate group ownership rather than making it world-readable.

Relaying from a mail server

If you already run a mail server and just want its outbound mail to leave through us.

Postfix smarthost / relayhost

/etc/postfix/main.cf

relayhost = [mail.send25.net]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt
smtp_tls_note_starttls_offer = yes

/etc/postfix/sasl_passwd · chmod 600

[mail.send25.net]:587    username:password

Then

sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd*
sudo systemctl reload postfix

The square brackets matter. They tell Postfix to use the hostname directly instead of looking up its MX record. Without them delivery fails, because mail.send25.net has no MX — we send mail, we don't receive it.

smtp_tls_security_level = encrypt makes TLS mandatory outbound. Use it rather than may, so a failed handshake stops the mail instead of quietly sending it unencrypted.

Microsoft 365 connector

Only needed if you want M365 to route outbound mail through us — most customers don't, and point their devices at us directly instead while leaving staff mail alone. That's simpler, and it's what we'd normally suggest.

Exchange admin center → Mail flow → Connectors.
New connector: from Office 365 to Partner organization.
Route through the smart host mail.send25.net.
Require TLS.

Talk to us before doing this one. Routing all of a tenant's outbound mail through a relay changes your sending profile substantially, and it interacts with your sending limits. It's a supported setup — it just isn't a change to make on a Friday afternoon.

What not to send through us

We'd rather tell you now than suspend your account later. This is not fine print — it's how the service stays reliable for everyone on it.

Yes	Scans, invoices, statements, purchase orders, alerts, backup reports, monitoring, password resets, form notifications, appointment reminders, receipts
No	Marketing campaigns, newsletters, anything to a purchased or scraped list, bulk mail to people who didn't ask for it

The line isn't about volume, it's about whether the recipient expects the message. A thousand invoices a day is fine. Two hundred newsletters to a list you bought is not — and it's the second one that gets a sending IP blocklisted, taking everyone else's invoices down with it.

If you need to send newsletters, use a platform built for it. We'll tell you that on the first call rather than take the business and deal with the fallout later. It's also why we cap volume per customer: the caps protect the customers who are already here.

What happens when you hit your limit. By default we defer rather than reject — your device is told to try again shortly, and the mail goes out once the window rolls over. Nothing is lost. If you'd rather have a hard failure so a runaway system is obvious immediately, we can set that instead; some customers prefer knowing loudly.

Request access Publish your DNS Full reference