Demfilz SMTP Mailer

Description

WordPress hands its email to the PHP mail function, which is unauthenticated and unreliable. Order confirmations, password resets and contact form messages go missing or land in spam.

Demfilz SMTP Mailer routes every message your site sends through a mail service that will vouch for it, then keeps a record of what happened.

Microsoft mailboxes are first class here

Microsoft has switched basic authentication off across Exchange Online, so plugins that only offer a user name and password no longer work for most tenants. This plugin gives you three ways in:

• Graph API with a signed in mailbox. Register an application, press Connect, sign in once. Works even when SMTP AUTH is disabled on the mailbox.
• Graph API with application permissions. No sign in at all. An administrator consents once, and the site sends as the mailbox you nominate. Pair it with an application access policy so the site can only use that one mailbox.
• SMTP with modern authentication. Ordinary SMTP to smtp.office365.com, but signed in with OAuth instead of a password.

Personal Outlook.com and Hotmail mailboxes work through the same Graph API mailer.

It finds out what happened after the send

Most mail plugins stop at “accepted by the server”. This one closes the loop:

• Bounce capture. For Microsoft and Google it reads the delivery reports that come back to the connected mailbox and parses the machine readable part, so a log entry flips from Delivered to Bounced with the real reason, such as 5.1.1 the address does not exist. For SendGrid, Mailgun, Brevo, Postmark and Resend it takes their delivery, bounce and complaint webhooks.
• A suppression list. Hard bounces and spam complaints go on it, and the plugin refuses to send to those addresses again. Repeatedly emailing dead addresses is what gets a domain throttled and blocklisted; this is the part that protects your sending reputation.
• Delivery confirmation. When a service confirms delivery, the log entry says so.

Every mailer included

• Microsoft 365, Exchange Online, Outlook.com and Hotmail
• Google Workspace and Gmail
• Any other SMTP server, with STARTTLS or SSL
• SendGrid
• Mailgun, United States or European region
• Brevo
• Postmark
• Resend
• The default PHP mail function, if you want the log and the alerts without changing how mail is sent

More than a connection

• Email log. Every message, who it went to, which mailer carried it, and the exact reason for any failure. Search it, filter it, download it as CSV, and open a single entry to see the headers.
• Suppression list. Addresses that bounced or complained, plus any you add by hand, with search, CSV export and one click removal. A message to a suppressed address alone is recorded as blocked; other recipients still get theirs.
• Automatic retries. A failed message is queued and tried again in the background, with the wait doubling each time.
• Backup mailer. When the first mailer fails, the finished message is handed straight to a second one, so nothing is lost while a provider is down.
• Failure alerts. A dashboard notice always, plus an optional email and a JSON webhook for your chat channel. Optional weekly summary.
• Domain records check. Looks up SPF, DKIM and DMARC for your sending domain and tells you what is missing, with the values your chosen mailer needs.
• Email controls. Switch off individual WordPress notifications, such as the new user emails or the automatic update reports.
• Test email tool. Sends a real message and shows you the whole conversation with the mail server when it fails.
• Import. Picks up settings left behind by WP Mail SMTP, Easy WP SMTP or Post SMTP.

Built carefully

• Passwords, API keys and OAuth tokens are encrypted with your site salts before they are stored, and are never printed back into the settings screen.
• Any setting can be pinned in wp-config.php instead of the database.
• The sign in flow is bound to a single use value tied to the administrator who started it.
• The from address is corrected automatically when a provider only accepts its own mailbox, which is the usual cause of “cannot send as this user” errors.
• Multisite aware. Network activate it and one set of credentials serves every site.
• Privacy exporter and eraser for the email log.
• No account with us and nothing of ours in the middle. Your site talks straight to the mail provider you chose, and the plugin never sends your data anywhere else. Every service it can contact is listed under External services below.

External services

This plugin sends your outgoing email through whichever mail service you choose in its settings. Nothing is sent anywhere until you pick a mailer and enter your own credentials for it, and no data is ever sent to Demfilz.

Depending on the mailer you select, the plugin contacts:

• Microsoft identity platform and Microsoft Graph (login.microsoftonline.com, graph.microsoft.com), used by the Microsoft 365 mailers. Sign in details you approve are exchanged for an access token, and each outgoing message (sender, recipients, subject, body and attachments) is posted to Graph for delivery. If you switch on reading bounce reports, the plugin also lists recent messages in the mailbox and fetches the ones that look like delivery reports. Terms: https://www.microsoft.com/licensing/terms/ Privacy: https://privacy.microsoft.com/privacystatement
• Microsoft Exchange Online SMTP (smtp.office365.com by default), used by the Microsoft 365 SMTP mailer, with the access token above. Same terms and privacy policy.
• Google (accounts.google.com, oauth2.googleapis.com, openidconnect.googleapis.com, gmail.googleapis.com), used by the Google Workspace and Gmail mailer. Sign in details you approve are exchanged for an access token, your address is read once to fill in the mailbox field, and each outgoing message is posted to the Gmail API for delivery. If you switch on reading bounce reports, the plugin also searches the mailbox for messages from mailer-daemon and fetches those. Terms: https://policies.google.com/terms Privacy: https://policies.google.com/privacy
• SendGrid (api.sendgrid.com), used by the SendGrid mailer. Each outgoing message is posted there with your API key. Terms: https://www.twilio.com/en-us/legal/tos Privacy: https://www.twilio.com/en-us/legal/privacy
• Mailgun (api.mailgun.net, or api.eu.mailgun.net in the European region), used by the Mailgun mailer. Each outgoing message is posted there with your API key. Terms: https://www.mailgun.com/legal/terms/ Privacy: https://www.mailgun.com/legal/privacy-policy/
• Brevo (api.brevo.com), used by the Brevo mailer. Each outgoing message is posted there with your API key. Terms: https://www.brevo.com/legal/termsofuse/ Privacy: https://www.brevo.com/legal/privacypolicy/
• Postmark (api.postmarkapp.com), used by the Postmark mailer. Each outgoing message is posted there with your server token. Terms: https://postmarkapp.com/terms-of-service Privacy: https://postmarkapp.com/privacy-policy
• Resend (api.resend.com), used by the Resend mailer. Each outgoing message is posted there with your API key. Terms: https://resend.com/legal/terms-of-service Privacy: https://resend.com/legal/privacy-policy
• Any SMTP server you enter yourself, used by the Other SMTP mailer. The message and your credentials go to the host you configure, and nowhere else.
• Google Public DNS (dns.google), used only when you press Check my domain on the Tools screen and only on hosts where PHP cannot look records up itself. The plugin sends the domain name of your from address to read its public SPF, DKIM, DMARC and MX records. Terms: https://policies.google.com/terms Privacy: https://developers.google.com/speed/public-dns/privacy
• A webhook address you enter yourself, if you switch failure alerts on and fill one in. The plugin posts the details of a failed or bounced message to that address.

The sending services above can also call your site (a REST endpoint the plugin registers under /wp-json/dsmtp/v1/events/) to report deliveries, bounces and complaints, but only if you paste the plugin’s webhook address into that service yourself.