Sending email through SMTP
Route the plugin's notifications through a real mail server instead of PHP mail, with presets for Gmail, Microsoft 365 and Resend.
- Intermediate
- 12 min read
- Applies to 2.0
Why not leave it to WordPress
By default WordPress hands its mail to wp_mail(), which on most hosts ends up
in PHP's mail() — a message with no authenticated sender, sent from an IP the
receiving side has no reason to trust. It works until it matters: password
resets and verification codes are exactly the mail that must not land in spam.
SMTP replaces that with an authenticated connection to a mail server that is allowed to send for your domain.
The settings live under User Access → Emails. They apply to everything the plugin sends — verification, password reset, magic links, notifications — not to mail from other plugins.
Turn it on
- Open User Access → Emails.
- Enable Use SMTP for sending emails. The connection fields appear.
- Pick a provider. The host, port and encryption fill themselves in.
- Fill in the sender identity and the credentials.
- Save, then use Test SMTP Connection.
The four providers
| Provider | Host | Port | Encryption |
|---|---|---|---|
| Gmail / Google Workspace | smtp.gmail.com | 587 | TLS |
| Microsoft 365 / Outlook | smtp.office365.com | 587 | TLS |
| Resend | smtp.resend.com | 465 | SSL |
| Other SMTP | yours | 587 | TLS |
Choosing one of the first three locks the host, port and encryption to the values that provider actually accepts — one less way to spend an afternoon on a typo. Other SMTP leaves all three editable for a host of your own, SendGrid, Postmark, Amazon SES, or your hosting company's server.
Gmail and Microsoft 365 are better connected with OAuth2 than with a password — see Connecting Gmail or Microsoft 365 with OAuth2. Google no longer issues app passwords for most Workspace configurations, and Microsoft has been switching basic authentication off tenant by tenant.
The fields
SMTP Host — the server address, smtp.gmail.com and so on.
SMTP Port — 587 for TLS, 465 for SSL, 25 only on a server you control and that is not blocked outbound. Most hosts block 25.
Encryption — TLS, SSL, or none. "None" is for a mail server on the same machine; over the network it sends your credentials in the clear.
SMTP Username / Password — the mailbox credentials, or the API-key pair the
provider gives you (Resend uses resend as the username and an API key as the
password).
From Email — the address recipients see. It has to be one the server is allowed to send for; a mismatch here is the most common cause of mail that is accepted and then silently binned.
From Name — the display name beside it. Your site's name, usually.
Test before you trust it
Test SMTP Connection sends a real message with the settings currently saved and reports back what the server said. A failure quotes the server's own error, which is usually more precise than any guess:
535 Authentication failed— wrong username or password, or basic auth is off for that accountConnection refused/ a timeout — the port is blocked outbound, ask your host553/Sender address rejected— the From address is not one this server may send for- The test passes but mail still goes missing — the connection is fine, so look at SPF, DKIM and DMARC for your domain
A passing test proves the plugin can hand mail to the server. It does not prove the message reaches an inbox. Publish SPF and DKIM records for the domain in From Email, and check them with any DMARC report tool before launch.
Where it fits
Nothing else needs configuring for the plugin's own mail to use this connection. The templates that fill those messages are separate — see Email Template Customization (Pro).
Next steps
Something missing or out of date? Tell support.