How to Set Up SMTP in WordPress Properly

An SMTP plugin configured with credentials and nothing else leaves your email unauthenticated.

That is the gap this article exists to close. The plugin changes how the message leaves your server. Whether the receiving server trusts it is decided by DNS records the plugin cannot publish for you, and skipping them produces a setup that looks finished and delivers no better than before. Why the two are different problems.

The job has two halves. Do both.

---

Before installing anything

Two decisions, and getting them right first avoids redoing the DNS work.

Which service will send. Your mailbox provider's SMTP at low volume, or a dedicated transactional service. The deciding factor is whether you can publish DNS records for your domain — if you cannot, no service will authenticate properly and the exercise is limited. Choosing a service.

Which address mail will come from. It must be on a domain you control and it should be a mailbox that exists. noreply@ addresses work technically and discard replies, which is a support cost rather than a delivery one — a monitored address is better where you can staff it.

---

Part 1 — The plugin

Any reputable SMTP plugin does the same job. The configuration is what matters.

Connection method. Most services offer SMTP credentials and an API. The API is more reliable where offered, because it avoids outbound port restrictions on shared hosting entirely and usually gives better error reporting.

If using SMTP, the settings are:

Setting	Value
Host	Your service's SMTP hostname
Port	587 with STARTTLS, or 465 with implicit TLS
Encryption	TLS. Never none
Authentication	On
Username / password	The service's credentials, not your mailbox login

Port 25 will usually fail, because most hosts block it outbound to prevent abuse. A timeout on 25 is that block, not bad credentials.

From name and From address. Set both explicitly. Force them, using the plugin's option to override what individual plugins set — otherwise a form or WooCommerce will substitute its own address and break alignment on that one message type.

Store the API key or password outside the database where the plugin supports it. Most allow a constant in wp-config.php. It keeps credentials out of database exports and backups.

---

Part 2 — The DNS records

This is the half that authenticates, and it is done at your DNS host, not in WordPress.

DKIM

Your sending service will give you records to publish — typically one or two CNAME records, or a TXT record containing a public key. Publish exactly what they give you, including the selector, which is the part before ._domainkey.

Then click verify in their dashboard. Do not skip this: an unverified domain means the service sends on your behalf without signing as you, and every message fails alignment.

DNS changes take time to propagate. If verification fails immediately after publishing, wait and retry rather than editing the record.

SPF

Add the service to your existing SPF record. Do not create a second one.

A domain with two SPF records fails SPF entirely — the specification permits exactly one, and receivers treat two as a permanent error. This is the single most common self-inflicted SPF failure.

So if you have:

v=spf1 include:_spf.google.com ~all

and your sending service tells you to add include:spf.example-service.com, the result is one record:

v=spf1 include:_spf.google.com include:spf.example-service.com ~all

Watch the lookup limit. SPF permits ten DNS lookups during evaluation, and each include may consume several. Exceeding ten causes a permanent error and SPF fails for everything — which is why adding a fourth or fifth service to a long-standing record sometimes breaks mail that was working. How to check and fix it.

DMARC

Not required to send, and the reason to publish one is that it tells you what is happening.

Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

That changes no delivery decisions and produces reports showing every source sending as your domain, whether it authenticated, and whether it aligned. On a WordPress site that is how you discover the plugin still sending directly through PHP mail — a source you did not know about, failing every check. Setting it up and reading the reports.

---

Part 3 — Verify it actually worked

Do not trust the plugin's test button alone. It confirms the connection, not the authentication.

Send a real message to an address where you can read full headers, then find the Authentication-Results header.

What you want to see:

• dkim=pass with header.d=yourdomain.com — the signing domain must be yours, not the service's
• spf=pass with smtp.mailfrom on your domain or an aligned subdomain
• dmarc=pass

The failure that looks like success: spf=pass where the domain shown belongs to your host or your sending service rather than to you. SPF is checked against the envelope sender, and DMARC requires that domain to align with your From domain. A pass on someone else's domain does not align, and DMARC fails despite the pass. If you have checked before and concluded authentication was fine, check which domain the pass was for.

Then test placement, which is a different question from authentication. Send to Gmail, Outlook and one other provider and note where each lands. Authenticated mail can still be filtered on reputation and content. What determines placement.

---

After it is working

Four things worth doing once, and one worth repeating.

Enable email logging. A log is the only record that a message was generated, what was in it, and what the service said about it. Without one you are diagnosing from customer complaints.

Set Reply-To deliberately. From is where the mail comes from; Reply-To is where a human reply should go. On order emails and form notifications these should usually differ.

Separate marketing sending. If the same domain sends campaigns, complaints from those campaigns degrade the reputation your password resets rely on. A subdomain for marketing keeps the two apart.

Remove any second sending path. Sites that accumulated a form plugin's own SMTP settings, plus a plugin-level override, plus the site-wide plugin will have messages leaving by different routes with different authentication. The DMARC reports show this clearly.

Re-test quarterly. Credentials expire, services change requirements, and DNS records get edited during unrelated work. The failure is silent, so nothing tells you.

---

Frequently asked questions

Do I need an SMTP plugin for WordPress?
For any site whose email matters, yes. Without one WordPress sends through PHP mail() from your web server, which is not in your SPF record and is not signing with DKIM for your domain, so messages fail DMARC alignment. The plugin is the transport half; the DNS records are the other half.

Which SMTP port should I use?
587 with STARTTLS, or 465 with implicit TLS. Port 25 is blocked outbound by most shared hosts as an anti-abuse measure, so a timeout there is that block rather than a credentials problem. Where the service offers an API, it avoids port restrictions entirely.

Can I have two SPF records?
No. The specification permits exactly one TXT record beginning v=spf1, and receivers treat a second as a permanent error that fails SPF for everything. Merge the includes into a single record.

Why does my email still go to spam after setting up SMTP?
Authentication and placement are separate. SMTP fixes transport, DNS records fix authentication, and placement is decided by reputation, content and recipient behaviour. Check the Authentication-Results header first to confirm the authentication half is genuinely passing on your domain.

Where do I put the SMTP password?
In a constant in wp-config.php if your plugin supports it, rather than in the database. It keeps the credential out of database exports and backups, which are copied and shared more often than people expect.

Do I need DMARC to send email from WordPress?
Not to send. It is worth publishing in monitoring mode anyway, because the reports show every source sending as your domain — which is how most people discover a plugin still sending directly through PHP mail alongside their configured service.