Hostinger Email Setup: Mailboxes, DNS and Deliverability

The five-minute version

Creating a mailbox in hPanel takes about two minutes. Making sure the mail you send from it lands in an inbox rather than a spam folder takes another fifteen, and that second part is the one people skip.

This guide covers both: the mailbox itself, the IMAP and SMTP settings for Gmail, Outlook and Apple Mail, and the three DNS records — SPF, DKIM and DMARC — that decide whether your email is trusted.

How many mailboxes you get

Mailboxes are counted per website, not per account, which is easy to miss.

After the first year, mailboxes renew at Hostinger’s standard rate. If you only need one address, that is fine. If you need twenty, a dedicated email provider will usually be cheaper than stacking mailboxes on top of hosting.

Creating the mailbox

Open Emails in the hPanel sidebar and choose the domain you are working with.

The form asks for a mailbox name — the part before the @ — a password, and optionally a display name and an autoresponder message. Two practical notes.

Use a password generated by a password manager rather than something you can type from memory. Mailbox passwords are stored in every client you connect, and a compromised mailbox is a far worse problem than a compromised website: it lets an attacker reset the passwords of everything else tied to that address.

And pick the address you will actually publish. hello@, sales@ and your own first name all work. admin@ and info@ attract more spam because they are the first guesses in every scraper’s list.

A rule worth following: create one mailbox per human, plus one role address for the website. Shared logins and forwarding chains are how a small business loses track of who sent what.

Connecting it to Gmail, Outlook and Apple Mail

Hostinger mailboxes work over standard IMAP and SMTP, so any client can use them. You do not need Google Workspace or Microsoft 365 to read your domain email inside those apps.

Confirm these against what hPanel displays for your mailbox, because Hostinger occasionally changes hostnames and the panel is always the source of truth.

Gmail

Gmail needs two separate settings, and people usually add only one of them.

• To send as your address: Settings → Accounts and Import → Send mail as → Add another email address. Enter the address, then the SMTP server above. Gmail will send a confirmation code to the mailbox, which you can retrieve from Hostinger webmail.
• To receive into Gmail: the same page, Check mail from other accounts → Add a mail account. Enter the IMAP details. Gmail polls on a schedule rather than instantly, so expect a delay of a few minutes.

Outlook

Add a new account and choose manual setup rather than letting Outlook auto-discover, which sometimes guesses a Microsoft server and fails. Select IMAP, enter the incoming and outgoing servers, and tick “require authentication for outgoing”.

Apple Mail on iPhone, iPad and Mac

Add an account, choose Other rather than a provider from the list, then Add Mail Account. Enter the IMAP and SMTP details by hand. On a Mac you can also fine-tune the outgoing port under Server Settings.

Deliverability: the part that matters

A mailbox that sends mail which lands in spam is worse than no mailbox, because you will not know it is happening. Three DNS records control this, and they do different jobs.

SPF — who is allowed to send

SPF is a TXT record that lists the servers permitted to send email for your domain. A receiving server checks the sending server’s IP against that list. If it is not on the list, the message fails SPF.

A typical Hostinger SPF record looks like this:

v=spf1 include:_spf.mail.hostinger.com ~all

The ~all at the end means “soft fail” — treat anything not listed as suspicious but do not reject it outright. Start there and tighten to -all once you are confident nothing else sends as your domain.

Two mistakes are common. First, publishing multiple SPF records: the standard permits exactly one TXT record beginning v=spf1, and two records cause a permanent failure. Second, exceeding the ten DNS lookup limit — each include: costs a lookup, so a domain that stacks Google, a CRM, a helpdesk and a newsletter tool can blow the budget and fail validation entirely.

DKIM — proof nothing was altered

DKIM adds a cryptographic signature to every outgoing message. The receiving server looks up a public key published in your DNS, verifies the signature, and confirms the message came from your domain and was not modified in transit.

Hostinger generates the DKIM record for you when you enable signing for the domain in hPanel. You do not have to invent the key. Copy the value exactly as shown, including any trailing part of the string — a truncated DKIM record is a silent failure.

DMARC — what to do when the other two fail

DMARC ties SPF and DKIM together and tells receivers what to do with mail that fails both. It also sends you reports about who is sending as your domain, which is how you find out that a forgotten plugin or a marketing tool has been spoofing you.

Start here:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1

p=none means “monitor and report, do not act”. Leave it there for a fortnight while you read the reports. When they show only legitimate senders, move to p=quarantine, and eventually to p=reject. Jumping straight to p=reject is how people break their own invoice emails.

The DNS record reference

The 10-emails-per-minute problem

This is the limit that catches people running a store or a busy contact form.

Hostinger caps server-based sending through PHP mail() — and similar — at 10 emails per minute and 100 emails per day, resetting on a rolling 24-hour basis. It is an anti-abuse control on shared infrastructure, and it applies to your website’s code, not to your mailbox.

What that means in practice: WordPress password resets, WooCommerce order confirmations, contact form notifications and newsletter signups all share the same hundred-a-day budget. A modest launch day will exhaust it, and the failure is quiet — the email simply does not send, and nothing in WordPress tells you.

The fix is to stop using mail() at all. Install an SMTP plugin such as WP Mail SMTP, point it at your Hostinger mailbox or at a transactional provider, and WordPress sends through a real authenticated mail server with proper SPF and DKIM alignment. The per-minute cap stops applying, deliverability improves, and you get logs showing what was actually sent. Our WordPress installation guide covers where that fits in the setup order.

Checking your work

Send a test message from the mailbox to a Gmail address you control, then open the message and view the original. You are looking for three lines.

• SPF: PASS
• DKIM: PASS with your domain in the d= value
• DMARC: PASS

If DKIM passes but shows a different domain in d=, you have a forwarding problem rather than an authentication one. If SPF fails, the sending IP is not covered by your record — check for a duplicate SPF record first.

Once all three pass and the domain has a few weeks of clean sending history, deliverability becomes largely a content question rather than a technical one.

Where email sits in the wider setup

Mailboxes are included on every plan, so this is not a reason to upgrade. Resources are. If you are running a store that sends order email, the daily backup and the second CPU core on Unlimited are worth more than the extra mailboxes. Our plan comparison breaks down what changes between tiers, and if you are still deciding, the hosting cost calculator will show what the renewal years actually cost rather than just the promotional rate.