By default, WordPress makes use of PHP Mail using the wp_mail function to send emails from contact forms, product orders and other functions that send out automated emails. However, PHP Mail lacks any form of authentication – it simply sends with the from address it’s provided directly from the server itself.
As a result, PHP Mail often gets used to spoof email addresses, commonly enough that some mail hosts simply mark emails from PHP Mail as spam or may even get blocked.
SMTP, on the other hand, connects to a mailbox directly and authenticates the connection using the mailbox password before it sends. This means that only setups with the correct mailbox details can actually send out emails, which is considered much more secure and can ensure that your site’s emails are less likely to be seen as spam and make their way to your intended recipients.