...
Editorial Staff
✅ email sending best practices
Learn about email sending best practices!

This article discusses email sending best practices for cPanel shared hosting and reseller hosting users.

Email is an essential part of operating a website, business, or online service. However, email sent from a shared hosting account must be handled responsibly to maintain reliable delivery and protect the reputation of the server and its users.

Shared hosting environments are different from dedicated mail platforms: many customers may share the same underlying mail infrastructure and, in some cases, outbound IP addresses. Poor sending practices by one account can therefore affect other users.

This guide explains how to send email responsibly from a cPanel shared hosting account, improve inbox placement, reduce delivery problems, and avoid account restrictions caused by excessive bounces, spam complaints, compromised scripts, or unsolicited bulk email.

Table of Contents

Email Sending Best Practices

  1. Understand the Difference Between Transactional and Bulk Email

    Before sending email, determine what type of messages you are sending.

    Transactional Email

    Transactional messages are generated as a direct result of an action taken by a user. Examples include:

    • Account registration confirmations
    • Password-reset messages
    • Order confirmations
    • Invoices and payment receipts
    • Support ticket notifications
    • Contact-form notifications
    • Shipping notifications
    • Security alerts
    • Website administrative notifications

    Normal transactional email is generally well suited for cPanel hosting.

    Marketing and Bulk Email

    Bulk or marketing email includes:

    • Newsletters
    • Promotional campaigns
    • Product announcements
    • Sales offers
    • Large mailing-list distributions
    • Automated marketing sequences
    • Cold outreach

    Shared hosting should not be treated as a dedicated bulk-email platform.

    Even legitimate marketing campaigns can generate enough volume, bounces, complaints, and reputation changes to affect a shared mail server.

    For substantial mailing lists or regular marketing campaigns, use a dedicated email delivery provider or email service provider (ESP). Examples include services specifically designed for newsletters, transactional delivery, or high-volume application email.

  2. Never Send Unsolicited Email

    Only send commercial or promotional email to recipients who have legitimately agreed to receive it.

    Do not:

    • Purchase email lists.
    • Scrape addresses from websites.
    • Harvest addresses from directories or social networks.
    • Use third-party lists with unclear origins.
    • Automatically subscribe customers without appropriate consent.
    • Send unsolicited cold-email campaigns through your hosting account.

    A technically valid email address is not automatically permission to send marketing email to it.

    For mailing lists, explicit opt-in is strongly recommended.

    Double Opt-In

    For higher-quality lists, consider double opt-in:

    1. A visitor enters their email address.
    2. Your system sends a confirmation message.
    3. The recipient clicks a confirmation link.
    4. Only then is the address activated.

    This substantially reduces:

    See Also: How to Install Osquery on Ubuntu VPS

    • Invalid addresses
    • Typographical errors
    • Bot submissions
    • Spam complaints
    • Malicious subscriptions
    • Spam-trap exposure

  3. Configure SPF, DKIM, and DMARC

    Modern email providers rely heavily on domain authentication.

    At minimum, domains sending email should have properly configured:

    SPF

    SPF identifies which mail servers are authorized to send email for your domain.

    In cPanel, check:

    cPanel → Email → Email Deliverability

    cPanel will normally identify SPF problems and provide the appropriate DNS record when corrective action is required.

    Avoid creating multiple independent SPF TXT records for the same domain. A domain should normally have one SPF policy incorporating all authorized sending services.

    DKIM

    DKIM cryptographically signs outgoing messages so receiving servers can verify that the message was authorized by your domain and was not modified in transit.

    cPanel normally manages DKIM through:

    cPanel → Email → Email Deliverability

    Verify that cPanel reports DKIM as valid.

    DMARC

    DMARC builds upon SPF and DKIM and tells receiving providers how mail claiming to originate from your domain should be authenticated.

    A new DMARC deployment can begin with a monitoring-oriented policy such as:

    v=DMARC1; p=none;

    However, DMARC policies should be designed around your actual email infrastructure. Do not blindly publish a restrictive quarantine or reject policy until every legitimate sender using your domain has been identified and properly authenticated.

    Once authentication and alignment have been verified, stronger enforcement can be considered.

  4. Use a Real Email Address as the Sender

    Avoid questionable sender addresses such as:

    wordpress@server-hostname.example

    or arbitrary addresses that do not actually exist.

    Instead, applications should generally send from a valid address associated with your domain, such as:

    support@example.com

    billing@example.com

    notifications@example.com

    or:

    noreply@example.com

    The domain in the From address should be properly configured for email authentication.

    For contact forms, do not use the visitor’s email address as the From address.

    For example, suppose a visitor enters:

    customer@gmail.com

    Your website should not attempt to send:

    From: customer@gmail.com

    from your cPanel server.

    That can cause authentication and DMARC failures because your server is not authorized to send mail on behalf of Gmail.

    Instead, use something similar to:

    From: Website Contact Form <website@example.com>
    Reply-To: customer@gmail.com

    This allows you to reply directly to the visitor without impersonating the visitor’s domain.

  5. Use SMTP Authentication for Applications When Appropriate

    Web applications can sometimes send email using the local PHP mail system, but authenticated SMTP is often preferable.

    See Also: 🚀 Deploy Poweradmin to Manage PowerDNS on Ubuntu VPS

    Applications such as WordPress, CRM systems, shopping carts, and custom applications can usually be configured with SMTP.

    Typical configuration includes:

    • SMTP hostname
    • SMTP port
    • Username
    • Password
    • TLS/SSL encryption
    • Authentication enabled

    In cPanel, configuration information for a mailbox can usually be found under:

    cPanel → Email Accounts → Connect Devices

    When possible, use encrypted SMTP.

    Common configurations include:

    • Port 465 with implicit TLS
    • Port 587 with STARTTLS

    Use the configuration supplied by your hosting provider rather than assuming a particular port or hostname.

  6. Protect Email Account Passwords

    A compromised mailbox can quickly be abused to send thousands of spam messages.

    Use:

    • Long, unique passwords
    • Randomly generated passwords
    • Different passwords for every mailbox
    • Password managers
    • Multi-factor authentication where supported

    Never reuse a cPanel, WordPress, FTP, or administrator password as an email password.

    If a mailbox suddenly begins sending spam, immediately:

    1. Change its password.
    2. Review devices and applications using the mailbox.
    3. Scan affected computers for malware.
    4. Check the website for compromise.
    5. Review forwarding rules and filters.
    6. Review available mail logs or delivery reports.
    7. Contact your hosting provider if the source cannot be identified.

    Changing the password alone may not solve the problem if a compromised website script is actually generating the messages.

  7. Keep Websites and Applications Secure

    A significant amount of abusive email from hosting accounts originates from compromised websites rather than legitimate email clients.

    Keep all applications current, including:

    Remove abandoned applications, plugins, themes, staging sites, and old installations.

    A forgotten WordPress installation can become an entry point for attackers even if the primary website is fully updated.

  8. Secure Contact Forms

    Public contact forms are frequent targets for automated abuse.

    Protect forms using appropriate anti-abuse measures such as:

    • CAPTCHA or challenge systems
    • CSRF protection
    • Rate limiting
    • Honeypot fields
    • Server-side validation
    • Submission throttling
    • Bot detection

    Do not create a form that accepts arbitrary recipient addresses and then sends messages to whatever address the visitor supplies. Such scripts can become open mail relays at the application level.

    Forms should send only to predetermined or properly authorized destinations.

  9. Keep Mailing Lists Clean

    One of the most important aspects of email reputation is list hygiene.

    Do not repeatedly send email to addresses that consistently fail.

    Remove addresses producing permanent failures such as:

    • User does not exist
    • Mailbox unavailable
    • Domain does not exist
    • Invalid recipient
    • Account disabled

    These are generally known as hard bounces.

    See Also: How to Deploy Mailman Suite on Debian VPS for Automated Mailing List Management

    Repeatedly attempting delivery to invalid recipients can make your traffic resemble spam.

    Why Bounce Rates Matter

    A healthy sender typically sends mail to recipients who actually exist and expect the messages.

    If a server sends thousands of messages and a significant percentage are returned because the addresses do not exist, receiving networks may conclude that the sender is:

    • Using an outdated list
    • Using a purchased list
    • Guessing addresses
    • Sending spam
    • Failing to maintain its database

    High bounce rates can also trigger outbound-mail safeguards imposed by your hosting provider.

  10. Honor Unsubscribe Requests

    Commercial mailing lists should provide an easy and functional method for recipients to unsubscribe.

    An unsubscribe request should be processed promptly.

    Do not:

    • Require recipients to contact support to unsubscribe.
    • Require account login merely to unsubscribe from marketing.
    • Continue mailing addresses that have opted out.
    • Re-add unsubscribed addresses without new consent.

    Maintaining a suppression list is often useful. Instead of simply deleting an unsubscribed address, the system records that the address must not be re-imported or mailed accidentally later.

  11. Do Not Send Large Email Blasts at Once

    Sending thousands of messages simultaneously from a shared hosting account can cause:

    • Queue congestion
    • Rate-limit violations
    • Temporary delivery failures
    • Server resource usage
    • Provider throttling
    • Reputation problems
    • Account restrictions

    If an application legitimately needs to distribute a moderate number of messages, use controlled queues and reasonable delivery rates.

    For example, rather than having a PHP process attempt to generate 5,000 messages immediately, an application can queue messages and process manageable batches.

    For genuinely high-volume distribution, move the workload to an email platform designed for it.

  12. Understand Provider Sending Limits

    Shared hosting providers commonly enforce limits such as:

    • Messages per hour
    • Recipients per message
    • Failed/deferred messages
    • Percentage of failed deliveries
    • Maximum message size
    • Concurrent SMTP connections
    • Mailing-list limits

    These limits protect the mail infrastructure and other customers.

    Do not attempt to bypass a provider’s limits by:

    • Creating multiple mailboxes
    • Rotating sender addresses
    • Spreading a campaign across multiple domains
    • Running scripts designed to evade hourly limits

    If your legitimate application exceeds shared-hosting limits, contact the hosting provider or migrate that email workload to an appropriate dedicated delivery service.

  13. Avoid Large Attachments

    Email is not an efficient file-transfer system.

    Large attachments:

    • Increase server storage usage
    • Consume bandwidth
    • Slow mail queues
    • Increase delivery failures
    • May exceed recipient limits
    • Can trigger security filters

    For large files, upload the file to an appropriate secure storage location and email the recipient a link instead.

    See Also: How to Install Microsoft SQL Server on Ubuntu VPS (10 Minute Quick-Start Guide)

    If sensitive information is involved, use authenticated or expiring download links rather than publicly accessible files.

  14. Avoid Spam-Like Message Construction

    There is no magic list of words that automatically determines whether an email is spam. Modern filtering systems evaluate many signals simultaneously.

    Still, poorly constructed messages can hurt deliverability.

    Avoid:

    • Misleading subject lines
    • Deceptive sender names
    • URL shorteners in unexpected contexts
    • Excessive links
    • Hidden text
    • Obfuscated URLs
    • Image-only emails
    • Misleading “Re:” or “Fwd:” subjects
    • Attachments with suspicious file types
    • HTML copied from questionable email templates

    Marketing email should clearly identify the sender and provide legitimate contact and unsubscribe information where required.

  15. Send Both HTML and Plain-Text Versions

    When an application supports it, send multipart email containing:

    • An HTML version
    • A plain-text alternative

    The HTML version should be reasonably simple and compatible with email clients.

    Avoid relying heavily on:

    • JavaScript
    • Embedded applications
    • Complex CSS
    • External scripts
    • Forms inside email

    JavaScript is generally blocked by email clients and should not be required for a message to function.

  16. Use Sensible Subject Lines

    Subject lines should accurately describe the message.

    Good examples include:

    • Your Example.com Invoice #12345
    • Password Reset Request
    • Your Order Has Shipped
    • Support Ticket #12345 Updated
    • Please Verify Your Email Address

    Avoid misleading subjects intended merely to generate opens.

    For example, do not use:

    Re: Our previous conversation

    if there was no previous conversation.

    Trust and consistency matter to both recipients and filtering systems.

  17. Separate Transactional and Marketing Email When Appropriate

    Businesses with substantial email requirements should consider separating different mail streams.

    For example:

    Normal business email

    employee@example.com

    Transactional application email

    notifications@example.com

    Marketing

    Handled through a dedicated email marketing platform.

    This prevents a problem with one type of traffic from unnecessarily affecting another.

    A large marketing campaign should not jeopardize delivery of password resets, invoices, support responses, and other important messages.

  18. Do Not Configure Unnecessary Forwarders

    Forwarding can create unexpected deliverability problems.

    For example:

    user@example.com → user@gmail.com

    If user@example.com receives spam, the cPanel server may subsequently forward that spam to Gmail.

    From Gmail’s perspective, your hosting server is now delivering the unwanted message.

    Modern forwarding can also interact with SPF and DMARC in complicated ways.

    Where practical, access the original mailbox directly rather than forwarding all incoming email to another provider.

    If forwarding is necessary, monitor it carefully and consult your hosting provider if forwarded mail experiences persistent delivery problems.

  19. Check cPanel Track Delivery

    cPanel includes a useful diagnostic feature:

    See Also: 🛒 How to Add WooCommerce Store to Existing Website (10-Minute Quick Start Guide)

    cPanel → Email → Track Delivery

    Depending on the hosting configuration, this interface can show whether a message was:

    • Accepted
    • Delivered
    • Deferred
    • Rejected
    • Routed elsewhere
    • Filtered

    When troubleshooting a missing message, check Track Delivery before repeatedly resending it.

    Pay particular attention to the response returned by the destination mail server. SMTP error messages frequently explain the problem.

  20. Understand Temporary vs. Permanent Failures

    Not every delivery failure means the same thing.

    Temporary Failures

    SMTP 4xx responses generally indicate temporary problems.

    Examples include:

    • Recipient server temporarily unavailable
    • Mailbox temporarily over quota
    • Rate limiting
    • Greylisting
    • Temporary reputation throttling

    The mail server may retry these messages automatically.

    Permanent Failures

    SMTP 5xx responses generally indicate permanent failures.

    Examples include:

    • Recipient does not exist
    • Domain refuses the message
    • Authentication policy failure
    • Message prohibited
    • Sender blocked

    Repeatedly resending a permanently rejected message usually does not solve the underlying problem.

    Read the complete SMTP response whenever possible.

  21. Test Deliverability Before Large Campaigns or Changes

    Before introducing a new application or changing your email infrastructure, test delivery to several major mailbox providers.

    For example, test accounts can be maintained at common providers such as:

    Check whether messages:

    • Arrive successfully
    • Go to Inbox
    • Go to Spam/Junk
    • Display correctly
    • Pass SPF
    • Pass DKIM
    • Pass DMARC
    • Contain the expected From and Reply-To addresses

    Viewing the original message headers can provide valuable authentication information.

  22. Monitor Your Domain’s Reputation

    Domain reputation increasingly matters independently of the outbound server’s IP reputation.

    Protect it carefully.

    Poor practices can affect the ability to send email even after moving to another mail provider.

    Factors that can negatively affect reputation include:

    • Spam complaints
    • Invalid recipient rates
    • Spam traps
    • Unsolicited marketing
    • Compromised accounts
    • Malware
    • Misleading messages
    • Sudden unexplained volume increases
    • Repeated authentication failures

    Building a good reputation takes time. Damaging one can happen quickly.

  23. Warm Up New High-Volume Sending Carefully

    A domain that normally sends 20 messages per day should not suddenly begin sending 50,000 messages per day from a new infrastructure without expecting additional scrutiny.

    Large legitimate senders should increase volume gradually while monitoring:

    • Bounce rates
    • Complaint rates
    • Deferrals
    • Blocks
    • Engagement
    • Authentication
    • Reputation

    For volumes large enough to require a formal warm-up strategy, a dedicated email delivery service is generally more appropriate than shared hosting.

  24. Be Careful With Automatic Replies

    Autoresponders can cause mail loops and may respond to spam.

    See Also: Install Modoboa Email Server on Debian VPS (1-Stop Complete Guide)

    Configure vacation messages and automated responses conservatively.

    Applications should recognize common automated-message indicators and avoid replying endlessly to other automated systems.

    Never create configurations where:

    System A automatically replies to System B, and System B automatically replies to System A.

    This can generate enormous numbers of unnecessary messages.

  25. Monitor Disk Quotas

    Email stored on the server consumes hosting-account disk space.

    If an account reaches its storage quota, problems can include:

    • Incoming messages being rejected
    • Applications failing
    • Backups failing
    • Mailboxes becoming inaccessible
    • Website functions malfunctioning

    Check usage under cPanel periodically and clean unnecessary:

    • Spam/Junk
    • Trash
    • Sent messages
    • Old attachments
    • Obsolete mailboxes

    If email retention requirements are substantial, select a hosting or email plan with appropriate storage.

  26. Do Not Treat Spam/Junk Folders as Permanent Storage

    Spam folders can accumulate enormous numbers of messages.

    Configure appropriate automatic cleanup policies where available.

    Likewise, periodically empty Trash folders and remove obsolete messages containing large attachments.

  27. Avoid Catch-All Mailboxes Unless Necessary

    A catch-all/default address accepts messages sent to addresses at your domain that may not actually exist.

    For example:

    anything-at-all@example.com

    could potentially be accepted even though no such mailbox was created.

    Catch-all configurations can attract substantial spam and make recipient management more difficult.

    Unless there is a specific business requirement, rejecting mail to nonexistent recipients is generally preferable.

  28. Verify DNS Before Troubleshooting the Mail Server

    Many apparent email problems are actually DNS problems.

    Verify:

    • MX records
    • A/AAAA records for mail hostnames
    • SPF
    • DKIM
    • DMARC

    If DNS was recently changed, allow for propagation and caching.

    If your DNS is hosted outside cPanel—for example with a DNS provider, CDN, or external nameserver service—records displayed inside cPanel may need to be manually copied to the authoritative DNS provider.

    Editing a DNS record inside cPanel does nothing if cPanel is not authoritative for the domain.

  29. Never Publish Credentials in Website Code

    SMTP credentials must be protected.

    Do not expose passwords in:

    • Public Git repositories
    • JavaScript
    • HTML source
    • Public configuration files
    • Support forum posts
    • Screenshots
    • Publicly downloadable backups

    For custom applications, store credentials in protected configuration files or environment variables inaccessible from the web.

    If credentials are accidentally exposed, change them immediately.

  30. Know When to Use an External Email Provider

    cPanel shared hosting is an excellent solution for ordinary website and business email, but it is not the correct platform for every workload.

    Consider a specialized provider when sending:

    See Also: ✅ Easily Setup Multilingual WooCommerce Store with Rad Web Hosting and WPML (Boost Your Sales!)

    • Large newsletters
    • High-volume transactional email
    • Marketing automation
    • Thousands of notifications
    • Large membership-site distributions
    • Application-generated email at scale
    • Time-sensitive high-volume alerts

    A common architecture is:

    Website on cPanel → SMTP/API email provider → Recipient

    Your website remains hosted normally while the specialized service handles outbound application mail.

    This provides better scalability, analytics, bounce processing, suppression management, and reputation controls.

Recommended cPanel Email Checklist

Before sending email from a new domain or website:

  • [ ] Create a legitimate sender mailbox.
  • [ ] Verify the domain’s MX records.
  • [ ] Check cPanel → Email Deliverability.
  • [ ] Confirm SPF passes.
  • [ ] Confirm DKIM passes.
  • [ ] Configure DMARC appropriately.
  • [ ] Configure applications to use a legitimate From address.
  • [ ] Use Reply-To for contact-form visitors rather than impersonating their address.
  • [ ] Use authenticated SMTP where appropriate.
  • [ ] Protect SMTP credentials.
  • [ ] Secure website contact forms against bots.
  • [ ] Keep CMS software, plugins, and themes updated.
  • [ ] Send only to legitimate recipients.
  • [ ] Remove permanently bouncing addresses.
  • [ ] Honor unsubscribe requests.
  • [ ] Monitor cPanel → Track Delivery for problems.
  • [ ] Keep mailbox and account disk usage under control.
  • [ ] Use a dedicated email service for substantial bulk or marketing traffic.

If Your Email Is Being Rejected

If outgoing messages suddenly begin failing, do not repeatedly resend them.

Instead:

  1. Open cPanel → Email → Track Delivery.
  2. Locate the failed message.
  3. Record the complete SMTP rejection message.
  4. Check cPanel → Email → Email Deliverability.
  5. Verify SPF and DKIM.
  6. Verify your DMARC configuration.
  7. Confirm the recipient address is valid.
  8. Check whether multiple recipients are failing or only one provider.
  9. Check whether your website or mailbox has been compromised.
  10. Contact your hosting provider with the rejection details if the cause remains unclear.

When contacting support, provide:

  • Your sending domain
  • Sender address
  • Recipient domain or address, when appropriate
  • Approximate date and time of the attempt
  • Complete SMTP error/rejection message
  • Whether the problem affects one recipient or multiple providers
  • Any recent DNS, website, or email configuration changes

Providing this information can significantly reduce troubleshooting time.

Final Recommendations

Reliable email delivery depends on more than simply having a functioning mailbox.

The most important practices are straightforward:

Authenticate your domain.
Maintain valid SPF, DKIM, and DMARC records.

Send only wanted email.
Do not use purchased, harvested, or unsolicited mailing lists.

Maintain clean recipient data.
Stop sending to addresses that permanently bounce.

Protect your account.
Use strong passwords and keep websites and applications updated.

Secure website forms.
Prevent contact forms and scripts from being exploited to generate spam.

Respect shared-hosting limits.
Do not attempt to circumvent hourly or recipient restrictions.

See Also: 🚀 Deploy Elastic Stack on Ubuntu VPS (5 Minute Quick-Start Guide)

Use the right platform for the workload.
Normal business and website-generated email is appropriate for cPanel hosting. Large-scale marketing and high-volume application email should generally be handled by infrastructure designed specifically for those purposes.

Responsible sending protects your domain’s reputation, improves inbox placement, and helps maintain reliable email service for everyone using the shared hosting platform.

Conclusion

You are now familiar with email sending best practices for cPanel shared hosting users.

✅ Easy Website Management with cPanel Support

Running a business is hard enough — managing your website shouldn’t be. That’s why we include full cPanel support with every hosting plan:

  • ✅ Simple Dashboard – No tech skills needed. Easily manage your website, emails, and more from one place.
  • ✅ Quick App Installs – Launch WordPress, shopping carts, or other tools with just one click.
  • ✅ Professional Email – Create business email addresses (like you@yourbusiness.com) in minutes.
  • ✅ Reliable Backups – Keep your website safe with easy-to-use backup and restore options.
  • ✅ Secure & Protected – Manage your site’s security and SSL certificates with built-in tools.
  • ✅ Real Help, Anytime – Our expert support team is available 24/7 for anything you need.

💬 What Our Customers Say

“I have had nothing but good experiences with Rad Web Hosting. The staff is there to help you to make sure that you stay online and I haven't had any downtime with my server in the time I have been with Rad Web Hosting and I have had my server for over two years.”

— Janice L., Owner of RJGM

🏆 Trusted by Small Business Owners Nationwide

Trust badges: 99. 9% uptime | 24/7 support | secure hosting | money-back guarantee

🚀 Get Started Today

Take the stress out of website management. With cPanel support and expert help just a click away, you can focus on what matters most — growing your business.

Choose Your Plan Now
Add as Preferred Source on Google
Avatar of editorial staff

Editorial Staff

Rad Web Hosting is a leading provider of web hosting, Cloud VPS, and Dedicated Servers in Dallas, TX.

Leave a Reply

lg