From installing the plugin to email that arrives: the from address, every mailer including Microsoft 365 both ways, the log, retries, alerts and the domain records that decide whether inboxes trust you.
Upload demfilz-smtp-mailer.zip under Plugins → Add New → Upload Plugin and activate it. A Mail menu appears in the admin with Settings, Email log and Tools. Nothing changes about how your site sends until you pick a mailer.
Open Mail → Settings. Use an address at your own domain: a Gmail or Hotmail address in the from field is rejected or filed as spam by most inboxes, whatever you send it through.
| Setting | What it does |
|---|---|
| From email | The address every message appears to come from. Tick the box under it to use it even when a plugin sets its own sender. |
| From name | The name shown next to that address. |
| Reply to | Optional. Used only when a message does not already set its own reply to address. |
| Return path | Sends bounce messages to the from address rather than to the web server account. |
Microsoft has switched basic authentication off, so a user name and password no longer work on most tenants. Choose Microsoft 365 and Outlook (Graph API) and pick one of the two sign in methods.
https://yoursite.com/wp-json/dsmtp/v1/auth/microsoft.Mail.Send for Microsoft Graph, then grant admin consent.Prefer to keep SMTP? Choose Microsoft 365 SMTP (modern authentication) instead: same application registration, but grant the delegated permission SMTP.Send, and make sure SMTP AUTH is enabled for the mailbox in the Microsoft 365 admin centre.
| Mailer | What you need |
|---|---|
| Other SMTP | Host, port and encryption (587 with STARTTLS suits almost every server, 465 needs SSL), plus the user name and password your provider gave you. |
| SendGrid | An API key with the Mail Send permission, and an authenticated sending domain. |
| Mailgun | A sending API key, your verified domain, and the region your account was created in. |
| Brevo | An API key from SMTP & API, with your sending domain added. |
| Postmark | The Server API token, and a confirmed sender signature or domain. |
| Resend | An API key with sending access, and a verified domain. |
All of the services above send over HTTPS, so they still work on a host that blocks SMTP ports.
Open Mail → Tools and send a test message. It goes out exactly as a real one would. If it fails, the tool shows the exact reason, and for SMTP the whole conversation with the mail server, which is usually enough to spot a wrong port, a refused login or a blocked connection.
Still landing in spam? Press Check my domain on the same screen. The plugin reads the public records for your sending domain and tells you what is missing:
| Record | Why it matters |
|---|---|
| SPF | Lists who may send for your domain. The check names the include your chosen mailer needs, such as spf.protection.outlook.com for Microsoft 365. |
| DKIM | Signs your mail so it cannot be tampered with. Turn signing on in your mail provider and publish the records they give you. |
| DMARC | Tells inboxes what to do when SPF and DKIM fail. Start with v=DMARC1; p=none and tighten it once you know all your mail passes. |
Mail → Email log lists every message with its status, the mailer that carried it and the plugin or theme that asked for it. Open an entry for the headers and the exact error, send it again, or download the whole log as CSV.
| Setting | What it does |
|---|---|
| Keep a log | Records every message. Message bodies are stored only if you tick the second box - leave that off on a live site, since reset links and customer details would sit in your database. |
| Delete entries after | Days to keep entries; 30 out of the box, 0 keeps them forever. |
| Try again after a failure | Queues a failed message and retries it in the background, the wait doubling each time. Needs WP Cron to be running. |
| Backup mailer | When the first mailer fails, the finished message is handed straight to a second one. Set that mailer up first, and make sure it accepts the same from address. |
| Alerts | An email and a JSON webhook when a message finally fails, at most one an hour. A dashboard notice always appears. |
| Weekly summary | An optional once a week note of what was delivered and what failed. |
Secrets are encrypted with your site salts, but you can keep them out of the database entirely by defining them in wp-config.php. A defined value wins and the field becomes read only:
define( 'DSMTP_MAILER', 'microsoft' );
define( 'DSMTP_FROM_EMAIL', 'notifications@example.com' );
define( 'DSMTP_MICROSOFT_CLIENT_ID', '...' );
define( 'DSMTP_MICROSOFT_CLIENT_SECRET', '...' );The pattern is DSMTP_ followed by the mailer name and the setting name, both in capitals.
"The client does not have permission to send as this user": the from address does not match the mailbox you connected. Fill in the mailbox field - the plugin then rewrites the from address to it and moves the original into reply to. With application permissions, check the application access policy covers that mailbox.
Connect does nothing, or the provider rejects the redirect: the redirect URI registered with Microsoft or Google has to match the one on the settings screen exactly, character for character, including https.
Mail stopped after a few months: client secrets expire. Create a new one in the provider's console and paste it in.
Queued messages never send: retries run on WP Cron. If DISABLE_WP_CRON is set, add a real cron job that hits wp-cron.php. The Tools screen tells you which is the case.
A warning about another mail plugin: only one plugin can own sending. Deactivate the other one, then send a test email again.
Branded transactional templates, delivery and bounce reporting, or a queue that survives a busy sale - we build those on request.