Why hosting servers are not suitable for mass emailing
Web hosting servers are optimised for running websites and handling regular email traffic - not for sending large volumes of newsletters or marketing emails. Sending large volumes of emails via a shared hosting server carries significant risks:
- Blacklisting: If a large number of emails are sent from a server within a short period of time, spam filters and blacklist providers classify the server’s IP address as suspicious. This then affects all customers on that server - including those who do not send bulk emails.
- Delivery issues: Emails from blacklisted IP addresses end up in the spam folder or are not delivered at all.
- Reputational damage: The reputation of the server IP is crucial for email deliverability. Mass emailing poses a long-term threat to this reputation.
- Resource strain: Sending thousands of emails places a strain on the CPU, RAM and network - to the detriment of all other customers on the server.
For these reasons, email sending limits are in place on our hosting servers to prevent mass emailing.
Email sending limits on SpeedIT servers
To protect the server’s reputation and ensure reliable email delivery for all customers, the following limits apply:
| Limit type | Description |
|---|---|
| Hourly limit | Maximum number of emails per hour per email address |
| Daily limit | Maximum number of emails per day (24 hours) per email address |
| Domain limit | Maximum number of emails per domain across all mailboxes |
These limits are set to ensure that normal business correspondence can take place without any problems. However, they are deliberately insufficient for sending newsletters or bulk emails.
Important: If the limits are exceeded, further emails will be temporarily rejected. This is to protect all customers on the server.
Sending newsletters via specialist service providers
For professional newsletter distribution, we recommend using specialised email marketing services. These offer key advantages:
| Advantage | Description |
|---|---|
| High delivery rate | Specialised servers with an excellent IP reputation and whitelisting with major providers |
| GDPR compliance | Double opt-in, unsubscribe links and logging of consents |
| Bounce management | Automatic detection and removal of invalid email addresses |
| Statistics | Detailed analyses of open rates, clicks and conversions |
| Scalability | Sending from thousands to millions of emails without technical restrictions |
| Templates & Editor | Professional newsletter templates and drag-and-drop editors |
| Automation | Autoresponders, trigger emails and marketing automation |
Recommended newsletter services
The following providers have a proven track record in German-speaking countries and offer GDPR-compliant solutions:
| Providers | Key features | Server location |
|---|---|---|
| CleverReach | German provider, easy to use, good value for money | Germany / EU |
| RapidMail | German provider, particularly focused on the GDPR | Germany |
| Brevo (formerly Sendinblue) | Extensive features, CRM integration, transactional emails | EU |
| Mailchimp | Market leader, extensive integrations, free starter plan | USA (Privacy Shield) |
| Newsletter2Go / Sendinblue | German support, good WordPress integration | Germany / EU |
Tip: For maximum GDPR compliance, we recommend providers with servers located in Germany or the EU.
PHP mail() and web forms - security guidelines
Many websites use the PHP function mail() for contact forms and automated notifications. However, this method poses significant security risks:
Why PHP mail() is problematic
- No authentication: Emails are sent without an SMTP login - the sender is not verified
- Vulnerability to spam: Attackers can exploit forms to send spam via your server
- Poor deliverability: Emails without proper authentication are more likely to end up in spam
- Header injection: Insecure forms can be exploited for email header injection
For these reasons, sending emails via PHP’s `mail()` function is strictly restricted on our servers.
Recommendation: Use SMTP authentication
For all web forms and automated email notifications, we strongly recommend using SMTP with authentication:
| Aspect | PHP `mail()` | SMTP authentication |
|---|---|---|
| Authentication | None | Username + password |
| Encryption | None | SSL/TLS |
| Deliverability | Low | High |
| SPF/DKIM | Problematic | Fully supported |
| Traceability | Difficult | Via mailbox logs |
| Risk of spam | High | Low |
Setting up SMTP in WordPress
For WordPress, we recommend the WP Mail SMTP or FluentSMTP plugin:
- Install the plugin via Plugins → Install
- Activate the plugin
- Go to the plugin settings
- Configure the SMTP connection:
| Setting | Value |
|---|---|
| SMTP host | Your server name (e.g. merkur.web.de-serv.de) |
| Encryption | SSL/TLS |
| SMTP port | 465 |
| Authentication | Enabled |
| Username | Your full email address |
| Password | Your email password |
Protecting web forms from spam attacks
Unprotected contact forms are a popular target for spam bots. A successful attack can result in thousands of spam emails being sent via your form - with corresponding consequences for your server’s reputation.
Recommended protective measures
| Measure | Description | Recommendation |
|---|---|---|
| Captcha | Verification that a human is filling in the form | Required |
| Honeypot fields | Invisible fields that only bots fill in | Additional |
| Rate limiting | Limiting the number of form submissions per IP address per time period | Additional |
| SMTP authentication | Email sending via an authenticated connection | Required |
| Input validation | Checking form entries for valid formats | Required |
CAPTCHA solutions
For CAPTCHA protection, we recommend privacy-friendly alternatives to Google reCAPTCHA:
- FriendlyCaptcha: GDPR-compliant, servers located in Germany, no cookies
- hCaptcha: Data protection-friendly alternative, no tracking
- Turnstile (Cloudflare): Invisible CAPTCHA, user-friendly
WordPress plugins with Captcha integration:
- Contact Form 7 with Flamingo
- WPForms
- Gravity Forms
- Ninja Forms
Summary: Best practices for sending emails
| Use case | Recommended solution |
|---|---|
| Newsletters & marketing emails | Specialised newsletter service (CleverReach, rapidmail, Brevo) |
| Contact form | SMTP authentication + CAPTCHA protection |
| Order confirmations (online shop) | SMTP authentication or transactional email service |
| Automatic notifications | SMTP authentication |
| Transactional emails (password reset, etc.) | SMTP or transactional email API (e.g. Brevo, Mailgun) |
Frequently asked questions
Can I have the email limits increased?
The limits are set system-wide and are in place to protect all customers. It is not usually possible to have them increased on an individual basis. For higher sending volumes, we recommend a specialised newsletter service or your own managed cloud server with a dedicated IP address.
Why do my form emails end up in spam?
Common causes:
- Sending via PHP mail() instead of SMTP
- Missing or incorrect SPF/DKIM records
- The sender address does not match the domain
- Content is flagged as suspicious by spam filters
→ Solution: Configure SMTP authentication and check your DKIM settings.
What happens if I exceed the limit?
Further emails will be temporarily rejected. You will receive an error message (e.g. “Rate limit exceeded”). Once the time window (hour/day) has elapsed, you will be able to send emails again.