1C-Bitrix Site Email Deliverability: Why Forms and Orders Go to Spam

1C-Bitrix («Управление сайтом», often just called Bitrix) is the dominant CMS for the Russian and CIS e-commerce market, powering a large share of online stores that serve Mail.ru, Yandex, and Gmail customers. It is a capable, if opinionated, platform — and like many enterprise CMSes it treats email as a utility that should just work.

In practice, a default Bitrix site sends mail using PHP's built-inmail() function, which means messages leave your web server with no authentication, often from the wrong IP, and frequently with a From address that has nothing to do with the website's real domain. The result: order confirmations («заказ оформлен»), contact form notifications («обратная связь»), and password resets go straight to the spam folder at Mail.ru and Yandex, or are dropped entirely.

How Bitrix sends email by default

Out of the box, Bitrix relies on three things: the PHP mail()function, your hosting provider's local sendmail / Postfix, and the From address configured in Настройки → Настройки продукта → Настройки модулей → Главный модуль. When a user submits an order, Bitrix renders the email template and calls\CEvent::Send(), which ultimately delegates to PHPmail().

This has several serious problems:

No authentication. Your web server's IP is almost certainly not in your domain's SPF record, and there is no DKIM signature at all.
Shared hosting reputation. If you are on a shared hosting plan, your neighbours' spam behaviour degrades your mail too.
No bounce handling. Hard bounces pile up silently, and Bitrix has no way to prune dead addresses.
No TLS enforcement. Modern providers increasingly require opportunistic TLS; some outright reject plaintext SMTP from untrusted senders.

The fix: SMTP relay + authentication

Step 1. Install an SMTP module

Bitrix Marketplace has several SMTP modules that replace the default transport. Common choices: sale.smtp,webnauts.smtp, or the Unisender / SendPulse / Mailganer official connectors if you use one of those platforms. For high-volume stores, a direct integration with an ESP beats a generic SMTP module.

After installation, configure it with an SMTP relay you trust. For the CIS market, options include Unisender, SendPulse, Mailganer, Mailgun EU, or a self-hosted Postfix. All of them will give you SMTP credentials, an authenticated sending domain, and bounce handling.

Step 2. Set up DNS: SPF, DKIM, DMARC

This is the step most Bitrix site owners skip, and it is the one that matters most.

example.ru.          TXT   "v=spf1 include:_spf.unisender.com ~all"
uni1._domainkey.example.ru.  TXT  "k=rsa; p=MIGfMA0GCSq..."
_dmarc.example.ru.   TXT   "v=DMARC1; p=none; rua=mailto:dmarc@example.ru"

The specific SPF include and DKIM selector depend on your ESP. Start DMARC at p=none, watch the aggregate reports for 30–60 days to confirm all legitimate mail passes, then tighten top=quarantine.

Step 3. Fix the From address

Bitrix has a global From configured in the main module, but individual mail events (SALE_NEW_ORDER, FORM_FILLING, etc.) often override it with a per-event From. Audit every mail event:

Go to Настройки → Настройки продукта → Почтовые события.
Check every event's template. The From field must be an address on a domain you control and have DKIM-signed.
Never set From to the visitor's own email. Use Reply-To instead.

Seed-testing against Mail.ru, Yandex, Gmail

After DNS changes propagate, verify with a seed test. The three mailbox providers that matter for the Russian and CIS market behave differently:

Mail.ru — strict about DKIM alignment and aggressive on shared-IP reputation. A misaligned DMARC will land you in spam immediately. They also honour theX-FKMS-Report feedback loop if you enroll.
Yandex — historically more lenient but increasingly filters on engagement. Cold contacts at Yandex will land in «Рассылки» (the promotions equivalent) until you build reputation.
Gmail — for CIS senders reaching customers with @gmail.com addresses, the usual Gmail rules apply: DMARC required for bulk, engagement-weighted filtering.

Seed mailboxes should include mail.ru, list.ru, bk.ru (all Mail.ru group), yandex.ru, yandex.com, gmail.com, and ideally outlook.com for B2B recipients. The inbox-check.online test covers the full CIS and global set in one run.

Bitrix integration in beta

A native Bitrix integration is in private beta — run placement tests in-platform and get alerts on drops.

→ Join the beta waitlist

Beyond SMTP: templates and engagement

Once authentication is solid, the next layer is template hygiene and list health:

Translate "magic" spam words. Order confirmation templates often contain phrases like «БЕСПЛАТНАЯ ДОСТАВКА» in caps. Caps-lock triggers spam heuristics in both RU and EN.
Prune the subscriber list. Bitrix's built-in newsletter module keeps every subscriber forever. Export, filter out 12-month-inactives, and reimport once a year.
Use a dedicated sending subdomain. Send transactional from mail.example.ru and marketing fromnews.example.ru, so a marketing misstep does not poison your order-confirmation reputation.
Monitor Postmaster Tools. Gmail Postmaster and Yandex Postoffice both offer domain-level reputation dashboards. Check them monthly.

FAQ

Is there a Bitrix setting that enables SMTP natively?

Not as such — Bitrix can be pointed at a local sendmail or use modules from the Marketplace. There is no built-in SMTP form in the core admin. You install a module or configure your server's MTA.

My hosting provider says they already handle SPF. Is that enough?

No. Shared-hosting SPF often only covers the hosting provider's outbound relay. You still need SPF/DKIM/DMARC for whatever external ESP or relay Bitrix actually uses after you install an SMTP module.

Do I need to warm up a new sending domain for Bitrix?

If you are moving from PHP mail() to an ESP, yes. Start with low volume (a few hundred per day), build over 2–3 weeks, and monitor bounces and complaints closely.

Why do my contact-form notifications still go to spam after all this?

The most common cause is that the contact form sets From to the visitor's address. Move that to Reply-To and use your own domain in From — this one change fixes a remarkable number of problem reports.