Ariful Islam

Hi @awr10e ,

The 422 Unauthorized response with Microsoft 365 usually means the Microsoft app/token is no longer being accepted, even if the connection was working previously. Since your logs show this started around July 15, 2026, I’d recommend checking the Microsoft app configuration first.

Please go through these points:

1. Make sure the email address set as the From Email in FluentSMTP is the same Microsoft 365 account used to authorize the connection.
2. In your Azure/Entra app, confirm the Redirect URI exactly matches the callback URL shown in FluentSMTP.
3. Verify the required Microsoft Graph permissions are still present and admin consent is granted.
4. Confirm the mailbox is active and properly licensed in Microsoft 365.
5. Remove the current Microsoft connection from FluentSMTP, then reconnect it once after verifying the above.

If the issue remains, please share:

• a screenshot of the FluentSMTP Microsoft connection settings
• a screenshot of the Azure/Entra app Authentication and API permissions sections

That will help us narrow it down further. Also, I will mark the topic as not resolved until resolved.

Thank you.

Hi @alexqbox ,

Apologies for the delayed reply. Thanks for sharing the screenshot.

The browser console error is only a side effect of the real problem: the FluentSMTP test-email AJAX request is returning an HTTP 500 from wp-admin/admin-ajax.php.

From our side, expected Outlook / Office 365 mailer errors should normally come back as a JSON response, so a raw 500 usually means one of these is happening before FluentSMTP can return its normal error message:

1. a PHP fatal error on the site
2. a plugin/theme conflict during the wp_mail() request
3. a server-level security rule such as ModSecurity/WAF blocking the request

Could you please do the following and share the result?

• Enable WordPress debug logging, reproduce the issue once, and send us the exact lines written to /wp-content/debug.log at the time of the failed test.
• If debug.log stays empty, please ask your host to check the server error log / ModSecurity log for that same request.
• Please also confirm whether the site is multilingual (WPML/Polylang or language-prefixed URLs). If yes, that is especially relevant for Microsoft 365 because Microsoft requires the redirect URI to match exactly, and multilingual callback URLs are a known source of Outlook authorization issues.

As an Office 365 sanity check, please also verify:

• the token was generated with the same mailbox that is used as the sender address
• the mailbox has an active Microsoft 365 license
• the Azure app has the required Microsoft Graph delegated permissions and admin consent

Once you share the debug/server log entry, we can usually pinpoint the exact cause very quickly.

Thank you

Hi @shanekryme ,

Apologies for the delay in replying. For FluentSMTP, you should not choose Single tenant for this setup.

Instead, we recommend selecting Any Entra ID tenant + Personal Microsoft accounts. This is Microsoft’s current wording for what was previously called the Multitenant + Personal Microsoft accounts option.

FluentSMTP’s Microsoft mailer currently uses Microsoft’s /common OAuth endpoints, so it is designed to work with a multitenant-style app registration rather than a tenant-specific (single-tenant) application.

If you’re only using a Microsoft 365 work or school mailbox, Any Entra ID tenant may also work. However, Single tenant is not the recommended option for FluentSMTP’s default Outlook/Microsoft 365 connection flow.

Also, please make sure the following settings are configured correctly:

• Platform: Web
• Redirect URI: https://yourdomain.com/wp-json/fluent-smtp/outlook_callback

If authentication still fails after making these changes, please share the exact error message or a screenshot, and we’ll be happy to guide you further.

Thank you.

Hi @lyk-1 ,

Thanks for sharing this. You’re right: ses:ListIdentities is not required by Amazon SES for sending emails.

In the current FluentSMTP SES setup, we use that permission during connection setup to fetch SES identities and show helper information such as available sender emails / verified domain details. However, the actual mail delivery path uses SES SendRawEmail, and AWS itself validates the sender identity when the message is sent. So for runtime email delivery, a send-only policy is the right least-privilege direction.

Also, ListIdentities may expose SES identity information from the AWS account, and it should not be a hard requirement for users who only want FluentSMTP to send WordPress emails.

For the current version, you may need to grant ses:ListIdentities temporarily while saving the SES connection, then remove it afterward and keep ses:SendRawEmail / ses:SendEmail for sending. Some dashboard helper details, sender discovery, or quota/identity information may not be available without read/list permissions, but sending should work with the send permission.

We agree this can be improved. We’ll treat ListIdentities and related read permissions as diagnostics instead of mandatory setup requirements, and we’ll review the AWS guide so users can choose a least-privilege send-only policy instead of broad full-access permissions.

Thanks again for the thoughtful report.

Hi @puregraphx ,

This error means FluentSMTP can reach the SMTP server, but PHP/OpenSSL is rejecting the SMTP server’s SSL/TLS certificate during the encrypted handshake: stream_socket_enable_crypto(): certificate verify failed

So this is not a password/authentication failure. It usually happens when the SMTP server certificate is expired, self-signed, missing an intermediate certificate, issued for a different hostname, or when the VPS has an outdated CA certificate bundle.

Because all FluentSMTP sites on the same VPS started failing at the same time, the most likely causes are:

1. The mail server’s SSL certificate expired or was renewed incorrectly.
2. The SMTP hostname in FluentSMTP does not match the certificate name. For example, using mail.domain.com while the certificate is only valid for server.hostname.com.
3. The mail server is not serving the full certificate chain.
4. The VPS/PHP CA bundle is outdated.
5. FluentSMTP is using TLS/STARTTLS while PostSMTP is using a different setting or bypassing SSL verification.

Please ask the VPS/mail server admin to test the SMTP certificate from the server:

openssl s_client -starttls smtp -connect SMTP_HOST:587 -servername SMTP_HOST -verify_return_error -showcerts

For SSL port 465:

openssl s_client -connect SMTP_HOST:465 -servername SMTP_HOST -verify_return_error -showcerts

They should check the certificate expiry date, subject/SAN hostname, issuer chain, and final verify result. The fix is to install/renew a valid certificate for the exact SMTP hostname, serve the full chain, and update the server CA bundle if needed. Also make sure the FluentSMTP settings use the correct pair: TLS with port 587, or SSL with port 465.

As a temporary diagnostic only, if the connection is set to “None” encryption and Auto TLS is enabled, disabling Auto TLS may confirm that the issue is with STARTTLS certificate verification. We do not recommend using that as a permanent fix if SMTP authentication is enabled, because credentials/email may be sent without proper TLS protection.

Thank you.

Hi @macpheeweb ,

The reason this may happen is that the Email Logs search currently searches only the main log fields: recipient, sender, and subject.

With Contact Form 7, the visitor/customer name or email might not get stored as the actual email recipient or sender. Instead, it is commonly included inside the email body, or sometimes in the Reply-To header. That’s why you can open the log and see the customer details in the message, but a regular search for that name or email may not return the corresponding log entry.

As a workaround, if the customer name or email appears in the message body, you can try searching using: body:customer@email.com or: body:Customer Name . This tells FluentSMTP to search specifically within the email body.

Your suggestion about adding a Name / Email column is a good one. At the moment, FluentSMTP does not store a separate customer name or email field because it logs outgoing WordPress emails in a generic way, and each form plugin structures those fields differently.

However, I’ve shared your suggestion as a feature request with our product team. Hopefully, it will be considered in future updates.

Thank you.