Set up Magento 1.9 and earlier to send email via SMTP

Archived document. Magento 1 has reached the end of its official support and should not be kept as a public platform without a replacement strategy. Setting up SMTP does not fix vulnerabilities in the core, extensions or dependencies.

The priority is to migrate to a supported version of Adobe Commerce or Magento Open Source. When an immediate migration is not feasible, assess with a specialist whether OpenMage offers a maintained transition compatible with your shop, extensions and requirements; do not treat it as a substitute for a migration plan.

SMTP during a transition

If you need to restore sending temporarily while you migrate:

• Isolate and protect the shop, limit administrative access and keep verified backups.
• Use only an SMTP extension that is maintained and compatible with the exact platform. Install a published, pinned version and verify its checksum or signature; do not download the master branch or unversioned code.
• Set up authentication and TLS with the mail provider's current parameters. Do not assume that localhost, port 25 or an unencrypted connection are correct.
• Use a dedicated account with the minimum permissions needed and rotate its credentials when the transition ends.
• Store secrets outside the public directory and outside the repository, using the protected configuration or the platform's secrets system. Do not embed credentials in transport or core files, or allow configuration files to be downloaded. Exactly where secrets go depends on the platform and how it protects its configuration.
• Test orders, password resets, forms and queues, and review SPF, DKIM, DMARC and the delivery logs.

Migration

1. Take stock of the catalogue, customers, orders, rules, integrations, extensions and customisations.
2. Prepare the supported destination in staging and choose maintained replacements for the old extensions.
3. Migrate and validate data, payments, taxes, email, scheduled tasks, SEO and performance.
4. Schedule the final switchover, rotate all secrets and take the Magento 1 installation off the public network.

Do not edit the core to insert an SMTP transport or embed credentials in that patch. That kind of modification sits outside the update cycle and increases the impact of an intrusion.

Keep the SMTP test separate from the order queue

A successful SMTP test confirms the connection used by that test, but it does not show that order emails are being processed. Check cron, queues and pending messages before resending: when processing resumes, old or duplicate notifications could go out.

If you use a maintained distribution derived from Magento 1, document its version and compatible extensions. Do not automatically apply current Adobe Commerce instructions to an old installation, or change mail provider to hide an application fault.