What is an SMTP relay for WordPress, and do you need one?

An SMTP relay is a mail server that takes the emails your WordPress site creates, checks your login, signs the messages for your domain and delivers them. WordPress can send mail without one, but then the messages leave your web host with nothing to prove they came from you, and many never reach an inbox. If form notifications, password resets or order emails go missing or land in spam, a relay is the usual fix.

How WordPress sends email by default

Every email WordPress sends goes through one function, wp_mail(). That includes password resets, comment notifications and the messages from form and shop plugins. The function builds the message with PHPMailer, a library bundled with WordPress. Unless something changes the settings, it then calls PHP’s built-in mail() function, which hands the message to a mail program on your web server. That program tries to deliver it straight to the recipient’s mail server.

Four things follow from this:

• There is no login. The server sends the message without signing in to anything. The receiving server sees a message that claims to be from your domain, arriving from a hosting IP address it knows nothing about.
• The From address is generic. Unless a plugin or form sets another one, WordPress uses wordpress@ followed by your site’s domain.
• Nothing proves the message is yours. Unless your host adds it, there is no DKIM signature, and the host may not be listed in your domain’s SPF record. Gmail’s sender guidelines have required SPF or DKIM from every sender since February 2024.
• “Sent” does not mean delivered. wp_mail() returns true when PHP accepts the message for handoff. It says nothing about whether the message arrived.

What an SMTP relay is

SMTP is the protocol mail servers use to pass messages along. A relay is a server that receives a message from you and passes it on towards the recipient. For a WordPress site that means your site connects to the relay, logs in, and hands over the message. Because you logged in, the relay knows the message is yours. It signs it with DKIM for your domain, and your SPF record can list the relay as an allowed sender. The receiving server now has something to check.

Two points often cause confusion:

• A WordPress SMTP plugin is not the relay. Plugins such as WP Mail SMTP or FluentSMTP do not send anything themselves. They change wp_mail() so it connects to a relay instead of calling mail(). You need both: the plugin and a relay to point it at.
• “SMTP relay” is also the name of specific products. Google Workspace has an SMTP relay service and Microsoft 365 has an SMTP relay that uses connectors. Both identify the sender by IP address (Microsoft can also use a certificate). That suits a printer or an office server with a fixed address better than a website on shared hosting. For a website, a client login to a mail server is simpler.

A relay that accepts mail from anyone, with no login and no other way to identify the sender, is called an open relay. Spammers abuse those. A proper relay only accepts mail from senders it can identify, by login or by IP address.

Signs you need an SMTP relay

• Form notifications, password resets or order emails never arrive, and they are not in spam either. See contact form not sending email and WooCommerce emails not sending.
• They arrive, but in the spam folder, and moving them out once does not help for long.
• You get bounce messages such as “Mail delivery failed: returning message to sender”. See what that bounce means.
• Email worked, then stopped after you moved to a new host or changed your DNS.
• Your host says it limits how many emails a site can send per hour, or has switched off PHP mail.

You may not need one if test emails from your site already reach the inbox at Gmail and Outlook, and the message headers show SPF and DKIM passing for your own domain (the section on testing below shows how to check). Many sites do not know their mail is borderline until the day a customer says an order email never came.

Three ways to set one up

There are three common choices. They differ in who runs the mail server and how much you can see about each message.

Your host’s mailbox

You create a mailbox such as [email protected] in your hosting panel and use that mailbox’s SMTP details. It is free with most hosting and quick to set up. The limits are the host’s, you usually get no delivery log, and the mail still comes from the host’s shared servers.

A Gmail or Microsoft 365 account

If your business email already runs on Google Workspace or Microsoft 365, you can send website mail through that account. Google requires an app password or OAuth sign-in. Microsoft says username-and-password sign-in for this method is being retired and recommends OAuth, and SMTP sign-in is off by default for organizations created after January 2020, so it has to be turned on for the mailbox. Both services send as the account’s own address unless you set up an alias or Send As permission. Both also have sending limits. Microsoft documents 30 messages a minute for SMTP client submission and 10,000 recipients a day per mailbox, and Google publishes its own. Neither was designed around website mail, so this suits a small site that sends little.

A transactional email service

A transactional email service exists to send automatic, one-to-one email such as receipts, resets and form notifications. You add your domain, publish the DNS records it gives you, and connect WordPress with SMTP details or an API key. You get a log of each message and its status. Services differ in price, free allowance and features, so check each one’s own pricing page before you choose. SecureSMTP is one of these services.

How to choose

• Volume. Count what your site sends in a busy day, not an average one: a sale, a spam burst on a form, or a membership renewal run. Mailbox-based options have sending limits that a busy day can reach. Google and Microsoft publish theirs, so read them before relying on either.
• From address. You want mail to come from an address on your own domain, and a reply to go to you or your customer. A mailbox setup ties the From address to the account. A transactional service lets you use any address on a domain you verified. Some form plugins set the visitor’s own address as the From address, which mail providers can reject. The visitor’s address belongs in Reply-To.
• Logs. When a customer says an email never came, you need to see whether it was sent, delivered or bounced. A Sent folder holds copies of what was sent; it is not a delivery log. Google’s Email Log Search and Microsoft’s message trace exist for administrators but are not built for checking website mail. A transactional service shows the status of each message in its dashboard. This is the difference you will notice most in daily use.
• Deliverability. Ask whether the service signs with DKIM for your domain, tells you which SPF and DKIM records to add, and stops sending to addresses that bounce. For a small site, a shared IP address from an established provider is normally fine; see shared vs dedicated IP.

What you need before you start

• The SMTP host name, for example smtp.example.com. Your relay shows it in its settings.
• A port and an encryption setting that match. Use port 587 with STARTTLS (plugins usually call it “TLS”), or port 465 with SSL/TLS (usually called “SSL”). Never mix them, for example 465 with “TLS”. Avoid port 25: it is for server-to-server mail and many hosts block it.
• A username and password, or an API key. Many services use the API key as the SMTP password. Treat it like a password. Some plugins let you store it in wp-config.php instead of the database.
• A From address on your own domain, such as [email protected].
• Access to your domain’s DNS. That is wherever your nameservers point: your registrar, your host or a service such as Cloudflare.

The DNS records are what let receivers trust the relay. You will usually add three kinds:

• SPF, a TXT record at the root of your domain that lists who may send for you. A domain can have only one SPF record. If you already have one, add the relay to it instead of creating a second.
• DKIM, a record the relay gives you (a TXT record, or a CNAME record, depending on the service) that lets receivers check the signature on each message.
• DMARC, a TXT record at _dmarc.yourdomain.com that tells receivers what to do when a message fails the other two.

SPF vs DKIM vs DMARC explains each one in plain terms.

Set up an SMTP relay on WordPress, step by step

1. Pick the relay from the three setups above and create the account or mailbox.
2. Add your domain and publish its DNS records. Wait until the relay says the domain is verified. Records can take a while to spread, so do this first.
3. Install one SMTP plugin (or the relay’s own plugin) from Plugins → Add New. Deactivate any other SMTP or mail-logging plugin. Only one can take over WordPress mail, and two of them fighting is a common cause of failures. Some themes and form plugins also have their own SMTP settings; turn those off.
4. Enter the connection details: host, port, encryption, and your username and password or API key. With a plugin that has a ready-made mailer for your service, choose it and paste the key instead.
5. Set the From email and From name to an address on the domain you verified. If the plugin has a “force From email” option, turn it on, so a form plugin cannot override it with a visitor’s address.
6. Send a test email from the plugin to an address you can check, then continue with the next section.

SecureSMTP does this for WordPress. Its plugin connects your site in a few minutes and sends wp_mail() and form emails through SecureSMTP, from your own domain with DKIM signing once you verify the domain with DNS records (until then, up to 10 test emails a day to your own address). Every email appears in the email log with its delivery status, and bounces and complaints go on a suppression list. SMTP on port 587 or 465 (see the SMTP docs) and a REST API also work, and the free plan covers 5,000 emails a month, 1 site and 1 sending domain, with paid plans from $7 a month. More on the SecureSMTP for WordPress page.

Confirm it works

1. Use the plugin’s test email. A success message means the relay accepted the message. If it fails, the plugin shows the server’s reply. The most common errors are explained in WP Mail SMTP not working.
2. Trigger a real email. Use Lost your password? on the WordPress login page, or submit one of your forms. A test email from the plugin does not prove your forms use the same path.
3. Read the headers. In Gmail, open the message, click the three dots and choose Show original. You want SPF: PASS, DKIM: PASS and DMARC: PASS, with your own domain next to them.
4. Check the relay’s log, if it has one. The message should show as delivered.
5. Send to more than one provider. Try a Gmail address and an Outlook address. One inbox result is not proof for the other.

Frequently asked questions