SMTP (Seznam, Zoho, custom)

SMTP is the most universal way to connect a mailbox to Frontmail. If you can send email from Thunderbird or Apple Mail, you can almost certainly send it from Frontmail too.

Choose SMTP when you want messages to come from an ordinary mailbox you already use (a contact form that lands in info@yourcompany.cz, a small website, a personal project) and your volume is low – tens or a few hundred emails a day. For higher volume, open/click tracking or bounce handling, pick a transactional provider such as Mailgun, Postmark or Amazon SES. See the services overview for a comparison.

Frontmail has presets for common servers, so you usually only fill in the username and password:

Preset	Host	Port	Encryption
Seznam.cz	smtp.seznam.cz	465	SSL/TLS
Zoho Mail – EU	smtp.zoho.eu	465	SSL/TLS
Zoho Mail – global	smtp.zoho.com	465	SSL/TLS
Gmail (app password)	smtp.gmail.com	465	SSL/TLS
Microsoft 365 SMTP	smtp.office365.com	587	STARTTLS
Custom server	your host	587 or 465	STARTTLS / SSL/TLS

Tip

For Gmail and Microsoft 365 we recommend the OAuth integrations instead – Gmail (OAuth) and Outlook / Microsoft 365. They need no password and survive password changes.

Prerequisites

• A mailbox that is allowed to send over SMTP. Some providers switch SMTP off by default or only allow it on paid plans.
• The username (usually the full email address) and a password.
• If the account has two-factor authentication, generate an app password and use it instead of your login password:
  • Seznam.cz: account settings → security → application passwords.
  • Zoho Mail: My Account → Security → App Passwords.
  • Gmail: Google Account → Security → 2-Step Verification → App passwords.
• The From address in your template must be the mailbox itself or an alias the server lets you send as. Most servers reject other senders.

Connect in Frontmail

1. In the dashboard open Email services → Add service → SMTP.
2. Fill in the form:

Field	Where to find it	Example
Server	Pick a preset, or Custom server	Seznam.cz
SMTP host	Only for custom: your provider’s help pages or mail client settings	mail.example.com
Port	465 for SSL/TLS, 587 for STARTTLS	587
Use SSL/TLS from the start	On for port 465, off for 587 (STARTTLS is then required)	off
Username	Usually the full email address	info@example.cz
Password	Mailbox password or app password	••••••••
Max emails per second	Optional; leave empty for the default (2/s)	1

3. Click Verify & save. Frontmail opens a connection, negotiates TLS and logs in – no email is sent.
4. The service is saved once the check passes. Credentials are encrypted with AWS KMS envelope encryption before they are stored; nobody at Frontmail sees them in plain text.

Plain-text connections

Frontmail refuses to send your password over an unencrypted connection: on ports other than 465, the server must support STARTTLS. Port 25 is rarely usable from cloud networks anyway.

Allowed servers

Custom servers must use one of the standard SMTP ports 25, 465, 587 or 2525 and a host name that resolves to a public IP address – private, loopback, link-local and other reserved networks are refused (also when you choose Save without verifying). The connection goes to exactly the address that was checked, and TLS still verifies the certificate for your host name. When the connection test fails, the dashboard shows whether the server rejected the login or couldn’t be reached, not the server’s raw reply.

DNS: SPF, DKIM and DMARC

With SMTP, the mail is sent by your mailbox provider’s servers, so DNS records are the ones that provider tells you to publish for your domain. If you use the provider’s own domain (e.g. @seznam.cz, @gmail.com), there is nothing to set up.

For your own domain the typical records are:

; SPF – one TXT record on the root domain, merge includes if you use several senders
example.cz.        TXT  "v=spf1 include:spf.seznam.cz ~all"      ; Seznam
example.com.       TXT  "v=spf1 include:zoho.eu ~all"             ; Zoho EU (zoho.com for global)

; DKIM – the key is generated in the provider's admin (selector names differ)
zmail._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0…"   ; Zoho example

; DMARC – start in monitoring mode
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

• Seznam Email Profi and Zoho both generate the DKIM key in their admin console; copy the selector and value exactly.
• Keep only one SPF record per domain. If you also send through another service, combine the includes: v=spf1 include:spf.seznam.cz include:mailgun.org ~all.
• Start DMARC with p=none, read the reports for a few weeks, then move to p=quarantine and eventually p=reject.

Note

Since 2024 Gmail and Yahoo require SPF or DKIM for all senders and SPF + DKIM + DMARC for bulk senders (roughly 5,000+ messages a day to Gmail). A contact form will not hit that threshold, but correct DNS still helps deliverability.

Hosts, ports and regions

• 465 – implicit TLS (“SSL/TLS”). Use it whenever the server offers it.
• 587 – submission with STARTTLS. Frontmail requires the upgrade to succeed.
• Zoho: use smtp.zoho.eu if your Zoho account lives in the EU data center (you log in at mail.zoho.eu), otherwise smtp.zoho.com. Using the wrong one fails with an authentication error. There are also .in, .com.au and other data centers – choose Custom server for those.
• Seznam: smtp.seznam.cz works for both free @seznam.cz / @email.cz addresses and Email Profi on your own domain.

Sending limits

Mailbox providers are not built for bulk sending and enforce daily caps. Exceeding them usually gets the mailbox temporarily blocked.

Provider	Approximate limit
Seznam.cz (free)	~100 recipients per day
Zoho Mail (paid)	a few hundred emails per day, lower on free/trial accounts
Gmail via SMTP	~500/day consumer, ~2,000/day Workspace

Set Max emails per second to 1 for mailbox-type servers to stay on the safe side.

Delivery tracking (webhooks)

SMTP has no delivery webhooks. Once the server accepts the message (250 OK), Frontmail records it as sent; if the server refuses it, the message is failed. What happens afterwards – delivery, a bounce arriving later as an email in your inbox, a spam complaint – is invisible to Frontmail.

That also means bounced addresses are not added to the suppression list automatically. If you need delivered, bounced and complained events, use a transactional provider.

Common errors

Frontmail sorts every provider error into one of three classes:

• auth – the service itself is broken (wrong password, revoked access, SMTP 535). The service is marked unhealthy and the owner gets an email plus a dashboard banner. If the template has a fallback service, the message is sent through it; otherwise the credit is refunded and the message waits in the hold queue as held_service_error. It goes out automatically once you fix the service – Frontmail re-checks it when you save the service and in the daily health check.
• permanent – this particular message cannot be sent (invalid recipient, sender not allowed, message rejected). The fallback service is tried if configured; otherwise the status is failed and the credit is refunded.
• transient – a temporary problem (timeouts, SMTP 4xx such as 421/450/451, throttling). Retried with exponential backoff; once retries are exhausted the message is failed and the credit is refunded.

Custom servers and refunds. With the Custom server preset the server is under your control, and after the DATA step it already has the whole message. So when a custom server rejects a message only after receiving it (a 5xx answer to the end of the message) or the connection times out or breaks while the message could have been transmitted, Frontmail keeps the credit – the message may have been delivered. Such a timeout is retried at most twice. Rejections before the message is sent (connection refused, login, MAIL FROM, RCPT TO) are still refunded, and the well-known presets (Gmail, Microsoft 365, Seznam, Zoho) are refunded as before. The ledger entry says refund skipped.

What you see	Class	What to do
535 5.7.8 Authentication failed / EAUTH	auth	Check the username; with 2FA on, create an app password. For Zoho check the EU vs global host.
530 5.7.0 Must issue a STARTTLS command first	auth	Switch to port 465 with SSL/TLS, or 587 with STARTTLS.
553 5.7.1 Sender address rejected: not owned by user (on MAIL FROM)	auth	Use the mailbox address (or a configured alias) as the From address in the template.
550 5.1.1 User unknown / No such user	permanent	The recipient address does not exist – see invalid recipient.
554 5.7.1 Message rejected as spam	permanent	Simplify the content, check SPF/DKIM, avoid URL shorteners.
421 4.7.0 Too many messages, try later	transient	You hit the provider’s rate or daily limit; lower Max emails per second.
451 4.3.0 Temporary local problem / 450 Mailbox unavailable	transient	Nothing – Frontmail retries automatically.
ETIMEDOUT / ECONNREFUSED	transient	Check the host and port; some servers block connections from cloud IP ranges.

Checklist

• Correct preset or host + port (465 SSL/TLS or 587 STARTTLS)
• App password if the account uses 2FA
• From address in the template = the mailbox or an allowed alias
• SPF, DKIM and DMARC published for your own domain
• Test connection passes
• Rate limit set low (1/s) and daily volume within the provider’s cap
• A transactional provider considered if you need bounce tracking