diff --git a/api.php b/api.php
index 52bb253..66e1fbc 100644
--- a/api.php
+++ b/api.php
@@ -1,5 +1,6 @@
 <?php
 header('Content-Type: application/json; charset=utf-8');
+require_once __DIR__ . '/smtp.php';
 
 // Rate limiting (simple file-based)
 function checkRateLimit($ip, $maxRequests = 5, $windowSeconds = 300) {
@@ -110,13 +111,9 @@ switch ($action) {
         if ($phone) $body .= "Puhelin: $phone\n";
         $body .= "\nViesti:\n$message\n";
 
-        $headers = "From: asiakaspalvelu@konesaliturku.fi\r\n";
-        $headers .= "Reply-To: $email\r\n";
-        $headers .= "Content-Type: text/plain; charset=UTF-8\r\n";
+        $mailResult = smtp_send($to, $subject, $body, $email);
 
-        @mail($to, $subject, $body, $headers);
-
-        echo json_encode(['success' => true]);
+        echo json_encode(['success' => true, 'mail_sent' => $mailResult['ok']]);
         break;
 
     case 'quote':
@@ -288,16 +285,13 @@ switch ($action) {
         }
         file_put_contents($quoteFile, json_encode($quotes, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE));
 
-        // Send email
+        // Send email via SMTP
         $to = 'asiakaspalvelu@konesaliturku.fi';
         $subject = 'Tarjouspyyntö: ' . $name . ($company ? " ($company)" : '');
-        $headers = "From: asiakaspalvelu@konesaliturku.fi\r\n";
-        $headers .= "Reply-To: $email\r\n";
-        $headers .= "Content-Type: text/plain; charset=UTF-8\r\n";
 
-        $mailSent = mail($to, $subject, $body, $headers);
+        $mailResult = smtp_send($to, $subject, $body, $email);
 
-        echo json_encode(['success' => true, 'mail_sent' => $mailSent]);
+        echo json_encode(['success' => true, 'mail_sent' => $mailResult['ok'], 'mail_debug' => $mailResult['error'] ?? null]);
         break;
 
     default:
diff --git a/config.php b/config.php
new file mode 100644
index 0000000..6657a84
--- /dev/null
+++ b/config.php
@@ -0,0 +1,8 @@
+<?php
+// SMTP-asetukset — EI versionhallintaan!
+define('SMTP_HOST', 'mx.mail2.fi');
+define('SMTP_PORT', 587);
+define('SMTP_USER', 'sivusto@konesaliturku.fi');
+define('SMTP_PASS', 'm3vE3ww!!1123GGG');
+define('SMTP_FROM', 'sivusto@konesaliturku.fi');
+define('SMTP_FROM_NAME', 'Konesali Turku');
diff --git a/smtp.php b/smtp.php
new file mode 100644
index 0000000..f35fe2b
--- /dev/null
+++ b/smtp.php
@@ -0,0 +1,135 @@
+<?php
+/**
+ * Yksinkertainen SMTP-lähetys ilman ulkoisia kirjastoja.
+ * Tukee STARTTLS + AUTH LOGIN.
+ */
+function smtp_send($to, $subject, $body, $replyTo = '') {
+    require_once __DIR__ . '/config.php';
+
+    $host = SMTP_HOST;
+    $port = SMTP_PORT;
+    $user = SMTP_USER;
+    $pass = SMTP_PASS;
+    $from = SMTP_FROM;
+    $fromName = defined('SMTP_FROM_NAME') ? SMTP_FROM_NAME : '';
+
+    $errors = [];
+
+    // Connect
+    $socket = @fsockopen($host, $port, $errno, $errstr, 10);
+    if (!$socket) {
+        return ['ok' => false, 'error' => "Connection failed: $errstr ($errno)"];
+    }
+
+    $resp = fgets($socket, 512);
+    if (substr($resp, 0, 3) !== '220') {
+        fclose($socket);
+        return ['ok' => false, 'error' => "Server greeting failed: $resp"];
+    }
+
+    // EHLO
+    fwrite($socket, "EHLO konesaliturku.fi\r\n");
+    $resp = '';
+    while ($line = fgets($socket, 512)) {
+        $resp .= $line;
+        if ($line[3] === ' ') break;
+    }
+
+    // STARTTLS
+    fwrite($socket, "STARTTLS\r\n");
+    $resp = fgets($socket, 512);
+    if (substr($resp, 0, 3) !== '220') {
+        fclose($socket);
+        return ['ok' => false, 'error' => "STARTTLS failed: $resp"];
+    }
+
+    // Enable TLS
+    $crypto = stream_socket_enable_crypto($socket, true, STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT | STREAM_CRYPTO_METHOD_TLSv1_3_CLIENT);
+    if (!$crypto) {
+        fclose($socket);
+        return ['ok' => false, 'error' => "TLS handshake failed"];
+    }
+
+    // EHLO again after TLS
+    fwrite($socket, "EHLO konesaliturku.fi\r\n");
+    $resp = '';
+    while ($line = fgets($socket, 512)) {
+        $resp .= $line;
+        if ($line[3] === ' ') break;
+    }
+
+    // AUTH LOGIN
+    fwrite($socket, "AUTH LOGIN\r\n");
+    $resp = fgets($socket, 512);
+    if (substr($resp, 0, 3) !== '334') {
+        fclose($socket);
+        return ['ok' => false, 'error' => "AUTH failed: $resp"];
+    }
+
+    fwrite($socket, base64_encode($user) . "\r\n");
+    $resp = fgets($socket, 512);
+    if (substr($resp, 0, 3) !== '334') {
+        fclose($socket);
+        return ['ok' => false, 'error' => "AUTH user failed: $resp"];
+    }
+
+    fwrite($socket, base64_encode($pass) . "\r\n");
+    $resp = fgets($socket, 512);
+    if (substr($resp, 0, 3) !== '235') {
+        fclose($socket);
+        return ['ok' => false, 'error' => "AUTH password failed: $resp"];
+    }
+
+    // MAIL FROM
+    fwrite($socket, "MAIL FROM:<$from>\r\n");
+    $resp = fgets($socket, 512);
+    if (substr($resp, 0, 3) !== '250') {
+        fclose($socket);
+        return ['ok' => false, 'error' => "MAIL FROM failed: $resp"];
+    }
+
+    // RCPT TO
+    fwrite($socket, "RCPT TO:<$to>\r\n");
+    $resp = fgets($socket, 512);
+    if (substr($resp, 0, 3) !== '250') {
+        fclose($socket);
+        return ['ok' => false, 'error' => "RCPT TO failed: $resp"];
+    }
+
+    // DATA
+    fwrite($socket, "DATA\r\n");
+    $resp = fgets($socket, 512);
+    if (substr($resp, 0, 3) !== '354') {
+        fclose($socket);
+        return ['ok' => false, 'error' => "DATA failed: $resp"];
+    }
+
+    // Build message
+    $fromHeader = $fromName ? "\"$fromName\" <$from>" : $from;
+    $msg = "From: $fromHeader\r\n";
+    $msg .= "To: $to\r\n";
+    $msg .= "Subject: =?UTF-8?B?" . base64_encode($subject) . "?=\r\n";
+    if ($replyTo) {
+        $msg .= "Reply-To: $replyTo\r\n";
+    }
+    $msg .= "MIME-Version: 1.0\r\n";
+    $msg .= "Content-Type: text/plain; charset=UTF-8\r\n";
+    $msg .= "Content-Transfer-Encoding: 8bit\r\n";
+    $msg .= "Date: " . date('r') . "\r\n";
+    $msg .= "\r\n";
+    $msg .= $body;
+    $msg .= "\r\n.\r\n";
+
+    fwrite($socket, $msg);
+    $resp = fgets($socket, 512);
+
+    // QUIT
+    fwrite($socket, "QUIT\r\n");
+    fclose($socket);
+
+    if (substr($resp, 0, 3) === '250') {
+        return ['ok' => true];
+    }
+
+    return ['ok' => false, 'error' => "Send failed: $resp"];
+}