From installing the plugin to email that arrives: the from address, every mailer including Microsoft 365 both ways, the log, retries, alerts and the domain records that decide whether inboxes trust you.
In your WordPress dashboard open Plugins → Add New, search for Demfilz SMTP Mailer and click Install, then Activate (it is on the official WordPress.org plugin directory). Or upload demfilz-smtp-mailer.zip under Plugins → Add New → Upload Plugin and activate it. A Mail menu appears in the admin with Settings, Email log and Tools. Nothing changes about how your site sends until you pick a mailer.
Open Mail → Settings. Use an address at your own domain: a Gmail or Hotmail address in the from field is rejected or filed as spam by most inboxes, whatever you send it through.
| Setting | What it does |
|---|---|
| From email | The address every message appears to come from. Tick the box under it to use it even when a plugin sets its own sender. |
| From name | The name shown next to that address. |
| Reply to | Optional. Used only when a message does not already set its own reply to address. |
| Return path | Sends bounce messages to the from address rather than to the web server account. |
Microsoft has switched basic authentication off, so a user name and password no longer work on most tenants. Choose Microsoft 365 and Outlook (Graph API) and pick one of the two sign in methods.
https://yoursite.com/wp-json/dsmtp/v1/auth/microsoft.Mail.Send for Microsoft Graph, then grant admin consent.Prefer to keep SMTP? Choose Microsoft 365 SMTP (modern authentication) instead: same application registration, but grant the delegated permission SMTP.Send, and make sure SMTP AUTH is enabled for the mailbox in the Microsoft 365 admin centre.
| Mailer | What you need |
|---|---|
| Other SMTP | Host, port and encryption (587 with STARTTLS suits almost every server, 465 needs SSL), plus the user name and password your provider gave you. |
| SendGrid | An API key with the Mail Send permission, and an authenticated sending domain. |
| Mailgun | A sending API key, your verified domain, and the region your account was created in. |
| Brevo | An API key from SMTP & API, with your sending domain added. |
| Postmark | The Server API token, and a confirmed sender signature or domain. |
| Resend | An API key with sending access, and a verified domain. |
All of the services above send over HTTPS, so they still work on a host that blocks SMTP ports.
Open Mail → Tools and send a test message. It goes out exactly as a real one would. If it fails, the tool shows the exact reason, and for SMTP the whole conversation with the mail server, which is usually enough to spot a wrong port, a refused login or a blocked connection.
Still landing in spam? Press Check my domain on the same screen. The plugin reads the public records for your sending domain and tells you what is missing:
| Record | Why it matters |
|---|---|
| SPF | Lists who may send for your domain. The check names the include your chosen mailer needs, such as spf.protection.outlook.com for Microsoft 365. |
| DKIM | Signs your mail so it cannot be tampered with. Turn signing on in your mail provider and publish the records they give you. |
| DMARC | Tells inboxes what to do when SPF and DKIM fail. Start with v=DMARC1; p=none and tighten it once you know all your mail passes. |
Mail → Email log lists every message with its status, the mailer that carried it and the plugin or theme that asked for it. Open an entry for the headers and the exact error, send it again, or download the whole log as CSV.
| Setting | What it does |
|---|---|
| Keep a log | Records every message. Message bodies are stored only if you tick the second box - leave that off on a live site, since reset links and customer details would sit in your database. |
| Delete entries after | Days to keep entries; 30 out of the box, 0 keeps them forever. |
| Try again after a failure | Queues a failed message and retries it in the background, the wait doubling each time. Needs WP Cron to be running. |
| Backup mailer | When the first mailer fails, the finished message is handed straight to a second one. Set that mailer up first, and make sure it accepts the same from address. |
| Alerts | An email and a JSON webhook when a message finally fails, at most one an hour. A dashboard notice always appears. |
| Weekly summary | An optional once a week note of what was delivered and what failed. |
Everything so far tells you a message was accepted. Delivery feedback tells you what happened next. Open Mail → Settings → Log and alerts and scroll to Delivery feedback.
| Setting | What it does |
|---|---|
| Suppression | Whether a hard bounce, and separately a spam complaint, puts the address on the suppression list. Both are on by default. Suppressed addresses are never emailed again; a message to them alone is recorded as Blocked, a message with other recipients goes out without them. |
| Microsoft and Google mailboxes | Reads the delivery reports that come back to the connected mailbox every fifteen minutes and marks the matching log entry Bounced with the reason. Needs read permission on the mailbox: Mail.Read for Microsoft (an application permission when using client credentials) or gmail.readonly for Google. After switching it on, press Disconnect and then Connect again on the mailer so the wider permission is granted. The Tools screen gains a Check for bounce reports now button. |
| Sending services | SendGrid, Mailgun, Brevo, Postmark and Resend post events to your site instead. Copy the webhook address shown for your service into its webhook settings, for bounce, dropped, spam complaint and (optionally) delivered events. The long secret in the address is the credential; Create a new secret if it is ever exposed. Mailgun can additionally verify a signing key, entered on its connection panel. |
Mail → Suppression list shows every suppressed address with the reason the provider gave, lets you add one by hand, remove one so it can be emailed again, and download the lot as CSV.
Secrets are encrypted with your site salts, but you can keep them out of the database entirely by defining them in wp-config.php. A defined value wins and the field becomes read only:
define( 'DSMTP_MAILER', 'microsoft' );
define( 'DSMTP_FROM_EMAIL', 'notifications@example.com' );
define( 'DSMTP_MICROSOFT_CLIENT_ID', '...' );
define( 'DSMTP_MICROSOFT_CLIENT_SECRET', '...' );The pattern is DSMTP_ followed by the mailer name and the setting name, both in capitals.
"The client does not have permission to send as this user": the from address does not match the mailbox you connected. Fill in the mailbox field - the plugin then rewrites the from address to it and moves the original into reply to. With application permissions, check the application access policy covers that mailbox.
Connect does nothing, or the provider rejects the redirect: the redirect URI registered with Microsoft or Google has to match the one on the settings screen exactly, character for character, including https.
Mail stopped after a few months: client secrets expire. Create a new one in the provider's console and paste it in.
Bounce reports are not being read: the connection was made before reading was switched on, so it lacks the read permission. Disconnect and connect the mailer again; the settings screen shows whether the permission is present.
Queued messages never send: retries run on WP Cron. If DISABLE_WP_CRON is set, add a real cron job that hits wp-cron.php. The Tools screen tells you which is the case.
A warning about another mail plugin: only one plugin can own sending. Deactivate the other one, then send a test email again.
Branded transactional templates, delivery and bounce reporting, or a queue that survives a busy sale - we build those on request.