Fix RiseCRM Email Delivery: Switch to Authenticated SMTP with SPF & DKIM

RiseCRM sends a lot of transactional email: invoice reminders, ticket replies, task assignments, and client onboarding messages. When those land in spam folders or vanish entirely, it usually comes down to one root cause: the CRM is still using PHP's built-in mail() function. Default PHP mail sends from your server without proper authentication, no signed headers, and often a mismatched envelope sender. Mailbox providers treat that traffic as suspicious.

The fix is to route RiseCRM through authenticated SMTP and back it with correct SPF and DKIM DNS records. This guide covers the full path—from the RiseCRM admin dashboard to your DirectAdmin or cPanel DNS zone—so notifications reach the inbox every time.

Why Default PHP Mail Fails for RiseCRM

The mail() function hands messages directly to the local MTA with no login credentials and no cryptographic signature. Three things go wrong:

• No authentication: Receiving servers can't confirm the message is authorized to use your domain.
• Missing DKIM signature: Nothing proves the email wasn't tampered with in transit.
• Envelope mismatch: The return-path frequently uses the server hostname instead of your real domain, tripping SPF checks.

Authenticated SMTP solves all three. You point RiseCRM at a real mailbox, it logs in with a password, and messages carry proper headers that align with your DNS records.

Step 1: Create a Dedicated Sending Mailbox

Create a real email account like crm@yourdomain.com for RiseCRM to authenticate against. Using a dedicated address keeps sending reputation isolated from personal inboxes.

• DirectAdmin (Evolution): Log in, go to Account Manager → E-mail Accounts → Create Account. Enter the username (e.g. crm), set a strong password, and save.
• cPanel (Jupiter): Log in, open Email → Email Accounts → Create. Choose the domain, enter crm, set a strong password, and click Create.

Note the outgoing server details. On our LiteSpeed stack the SMTP host is your domain or mail hostname, port 465 for SSL/TLS or 587 for STARTTLS.

Step 2: Configure SMTP in the RiseCRM Dashboard

RiseCRM has a built-in email settings panel—no code edits required.

1. Log in to RiseCRM as an administrator.
2. Go to Settings (gear icon) → Email settings (or Settings → Configuration → Email depending on version).
3. Set Email protocol to SMTP instead of the default PHP mail.
4. Fill in the fields:
   • SMTP host: mail.yourdomain.com
   • SMTP port: 465
   • SMTP user: crm@yourdomain.com
   • SMTP password: the mailbox password from Step 1
   • Security type: SSL (use TLS if you chose port 587)
5. Set the Email sent from address to crm@yourdomain.com—this must match the authenticated account so SPF and DKIM align.
6. Click Save, then use the Send test email button to confirm delivery.

If the test fails with a connection timeout, try port 587 with TLS. Some networks throttle 465. If you get an authentication error, re-check the full email address as the username—not just the prefix.

Step 3: Add an SPF Record

SPF (Sender Policy Framework) tells receiving servers which hosts may send mail for your domain. Without it, authenticated SMTP still risks spam filtering.

A typical SPF record for mail sent from your own Hostiso server:

v=spf1 +mx +a ~all

Or reference the server directly if you send only through it:

v=spf1 a mx include:yourdomain.com ~all

• DirectAdmin (Evolution): Go to Account Manager → DNS Management. Look for an existing TXT record starting with v=spf1. Edit it, or click Add Record, set Type to TXT, Name to @, and paste the value. Save.
• cPanel (Jupiter): Open Domains → Zone Editor, click Manage next to your domain. Add or edit the TXT record for the root domain with the SPF value.

Keep only one SPF record per domain. Multiple SPF records break validation.

Step 4: Enable and Verify DKIM

DKIM adds a cryptographic signature so receivers can verify the message truly came from your domain and wasn't altered. Both control panels can generate DKIM keys automatically.

• DirectAdmin (Evolution): DKIM is typically enabled per-domain at account creation. To confirm, go to Account Manager → DNS Management and check for a TXT record named x._domainkey. If missing, ask your administrator to run DKIM key generation, or enable it under E-mail Manager tools where available.
• cPanel (Jupiter): Open Email → Email Deliverability. Locate your domain and click Manage. cPanel shows the status of DKIM, SPF, and PTR. If DKIM shows a problem, click Install the suggested record to auto-apply the correct default._domainkey TXT value.

The cPanel Email Deliverability tool is the fastest way to spot and fix DNS misalignments—it flags exactly which record is missing or incorrect and offers a one-click repair.

Step 5: Test and Validate Delivery

After DNS changes propagate (allow up to a few hours), verify the setup:

1. Send a test message from RiseCRM to an external address like Gmail.
2. Open the received message, click the three-dot menu, and choose Show original.
3. Confirm SPF: PASS and DKIM: PASS in the header summary.
4. Trigger a real CRM event—assign a task or generate an invoice—and confirm the notification arrives in the inbox, not spam.

If DKIM shows none or fail, double-check that the sending address matches your domain and that the DKIM TXT record was published without line-break errors. A slow header response can also point to broader performance issues; our guide on Time to First Byte covers server responsiveness worth reviewing.

Troubleshooting Common Delivery Issues

High-volume CRMs may hit hourly send caps on shared plans. If RiseCRM powers heavy client communications, a Cloud VPS gives you dedicated sending headroom, while Shared Hosting suits smaller teams. For queued or scheduled sends, review how cron jobs drive automated email processing—the same scheduling logic applies to RiseCRM's background tasks.

Frequently Asked Questions

Should I use port 465 or 587?

Both work on our LiteSpeed mail stack. Port 465 uses implicit SSL and is the most reliable default. Use 587 with STARTTLS only if 465 is blocked by an upstream firewall.

Do I still need SPF if DKIM passes?

Yes. Modern providers evaluate both, and DMARC alignment (if you add a DMARC record later) requires at least one of them to pass and align with your From domain. Publishing both maximizes inbox placement.

Why do my RiseCRM emails still go to spam after SMTP setup?

Confirm the From address matches the authenticated mailbox, both SPF and DKIM show PASS in message headers, and your domain has no prior spam reputation damage. New sending domains also benefit from gradually warming up volume rather than blasting hundreds of messages on day one.