# PHPMailer setup

PHPMailer 7.0.2 source files supplied for the project are located in `vendor/phpmailer/src/`. Their original copyright and LGPL headers are preserved.

## Setup

1. Copy `.env.example` to `.env`.
2. Add the SMTP host, port, encryption, username, password, sender, and reply-to address.
3. Keep `MAIL_ENABLED=false` during initial configuration.
4. Load `config/bootstrap.example.php` from a private test script.
5. Load `config/phpmailer_factory.php` and create the mailer with the `mail` configuration array.
6. Send one message to an address you control.
7. Confirm SPF, DKIM, and DMARC for `instantaivirtuals.com` before production email.
8. Set `MAIL_ENABLED=true` only after the test succeeds.

## Prepared templates

- Welcome email
- Email verification
- Password reset

Verification and reset tokens must be random, single-use, short-lived, and stored only as SHA-256 hashes. The raw token belongs only in the emailed HTTPS link.

Do not place SMTP passwords in PHP source files or SQL exports.