NimblyMail

NimblyMail is a comprehensive SMTP and email logging plugin designed to fix WordPress email deliverability issues. By default, WordPress uses the unreliable PHP <code>mail()</code> function, which often causes emails to land in the spam folder or never deliver. NimblyMail solves this by reconfiguring WordPress to securely route your site’s emails through a proper SMTP server or dedicated email provider.
Whether you need to connect via a standard SMTP host, Gmail OAuth, Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, or ZeptoMail, NimblyMail ensures your emails reach the inbox. Plus, with comprehensive email logging, a background queue, a developer sandbox, and an automated deliverability audit, you get full delivery monitoring and one-click troubleshooting.
<h4>At a glance</h4>
<ul>
<li>Nine email providers — SMTP, Gmail OAuth, Outlook / Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, ZeptoMail, and PHP mail.</li>
<li>Free Email Logging — Comprehensive log with search, status filters, and one-click resend of failed emails.</li>
<li>Background Queue — Defer wp_mail() calls to a non-blocking queue powered by Action Scheduler, with three-tier priority, exponential backoff retries, and admin tools to retry or cancel pending mail.</li>
<li>Developer Sandbox — Stop staging and local environments from sending real email. Choose Log Only (capture and short-circuit) or Redirect (rewrite every recipient to a single safe address). Optional allowlist for addresses that should bypass the sandbox.</li>
<li>Deliverability Health Audit — Automated DNS-based audit of SPF, DKIM, DMARC, and PTR for the active sender domain, with scheduled checks and human-readable findings per pillar.</li>
<li>Clean, Modern Dashboard — Delivery stats, connection health, queue health widget, deliverability summary, and recent activity at a glance.</li>
<li>Selectively disable WordPress notification emails across 8 categories (over 25 individual triggers).</li>
<li>Failure alerts delivered via PHP’s native <code>mail()</code> so a broken transport can’t silence them.</li>
<li>AES-256-CBC credential encryption with optional PHP-constant overrides in wp-config.php.</li>
<li>First-class WordPress Multisite support with network defaults, per-site overrides, and per-field locks.</li>
<li>Guided setup wizard with auto-detection and one-click import from existing SMTP plugins.</li>
</ul>
<h4>Supported Email Providers</h4>
<ul>
<li>Other SMTP — Connect to any SMTP server (Outlook, Office 365, Mailgun, SendGrid, Zoho, etc.)</li>
<li>Gmail / Google Workspace — Authenticate securely via Google OAuth without managing your own Google Cloud credentials.</li>
<li>Outlook / Microsoft 365 — Authenticate via Microsoft OAuth and send through <code>smtp.office365.com</code> without registering your own Azure application.</li>
<li>Amazon SES — Send via AWS Simple Email Service</li>
<li>Resend — Modern email API for developers</li>
<li>SendLayer — Transactional email delivery service</li>
<li>Brevo — Transactional email API (formerly Sendinblue)</li>
<li>ZeptoMail — Zoho’s transactional email service with regional endpoints</li>
<li>Default (PHP) — Fallback to the built-in PHP mail function</li>
</ul>
<h4>Email Logging</h4>
Every outgoing email is logged with recipient, subject, status, headers, and optional body capture. Search and filter logs by status (sent, failed, pending), resend failed emails with one click, and view full message details in a modal preview.
<h4>Background Queue</h4>
Turn the queue on under NimblyMail > Settings > Mail Queue and every wp_mail() call returns immediately. Messages are persisted to a database queue, dispatched by Action Scheduler in priority order (high / normal / bulk), and retried with exponential backoff on transient failures. Attachments are staged on enqueue so request-scoped tmp files cannot break delayed delivery. The Queue admin screen lists pending and failed items with retry / cancel actions, and the dashboard surfaces a queue-health widget. Test emails and admin alerts continue to send synchronously by default so you always get immediate feedback.
<h4>Developer Sandbox</h4>
Working on a staging copy or local clone? Turn on the sandbox to guarantee no real customer ever receives an accidental email. Pick Log Only to capture and short-circuit every wp_mail() call so they show up in the Email Log without leaving the host, or Redirect to rewrite every recipient to a single safe address with the originals preserved in <code>X-NimblyMail-Original-*</code> headers and a configurable subject prefix. An allowlist (exact email or <code>*@domain.com</code>) lets through addresses you do want delivered for testing. Sandboxing is settings-driven, switchable from the Network Admin on multisite, and visible at a glance via an admin-bar badge.
<h4>Deliverability Health Audit</h4>
NimblyMail runs an automated DNS audit of the active sender domain on a schedule (and on demand) and surfaces the result on the Deliverability page and the dashboard. The audit covers four pillars — SPF, DKIM, DMARC, and PTR — and is mailer-aware: required SPF includes and DKIM selectors are sourced from whichever provider you have configured (Gmail, Outlook 365, SES, etc.), with skip explanations for cases where a check does not apply. Findings are human-readable: each pillar shows pass/warn/fail with a one-line reason and a link to the relevant provider documentation.
<h4>Email Controls</h4>
Selectively disable WordPress notification emails you don’t need — comment notifications, password reset emails, new user registrations, automatic update notices, and more. Over 25 individual email types across 8 categories can be toggled on or off.
<h4>Failure Alerts</h4>
Receive instant alerts when emails fail to deliver. Configure alert recipients with optional CC and BCC addresses. Alerts are sent via PHP’s native mail function to bypass the broken transport.
<h4>Security</h4>
Credentials (SMTP passwords, API keys) are encrypted at rest using AES-256-CBC with HMAC-SHA256 verification. Settings can be locked via PHP constants in wp-config.php, making sensitive fields read-only in the admin UI.
<h4>Settings Import</h4>
Migrating from another SMTP plugin? NimblyMail automatically detects existing SMTP-plugin configurations and offers one-click import through the setup wizard.
<h4>WordPress Multisite</h4>
First-class multisite support. Network-activate the plugin once and every sub-site inherits the network defaults until a site admin explicitly overrides a field. Super admins get a Network Admin → NimblyMail surface with an aggregated dashboard, a sites table, per-field locks, and a per-site override editor.
<h4>Clean Dashboard</h4>
Built with Vue 3 and Ant Design, the dashboard is fast, responsive, and designed to feel native to WordPress. A guided setup wizard helps you configure everything in minutes, while the main dashboard provides a clear overview of your email delivery health.
<h3>Development and source code</h3>
The complete, human-readable source code for NimblyMail is maintained in the public WordPress.org SVN repository for this plugin. Browse it directly in your web browser via the Trac UI:
<ul>
<li>Browse source: https://plugins.trac.wordpress.org/browser/nimblymail-smtp/trunk/</li>
<li>SVN checkout: <code>svn checkout https://plugins.svn.wordpress.org/nimblymail-smtp/trunk/ nimblymail-smtp</code></li>
</ul>
The repository <code>trunk/</code> directory contains:
<ul>
<li><code>src/</code> — the PHP backend (PSR-4 autoloaded, plain readable PHP).</li>
<li><code>apps/</code> — the Vue 3 + TypeScript single-page apps (Dashboard, Settings, Email Logs, Tools, Setup Wizard, Network Admin) that get compiled into the minified bundles under <code>dist/</code>.</li>
<li><code>package.json</code>, <code>package-lock.json</code>, <code>tsconfig.json</code>, <code>tsconfig.node.json</code>, <code>vite.config.ts</code> — the build configuration needed to reproduce the exact <code>dist/</code> bundles.</li>
<li>The current <code>dist/</code> build output plus per-bundle source-map files (<code>*.js.map</code>, <code>*.css.map</code>).</li>
</ul>
The minified JavaScript and CSS files under <code>dist/</code> are produced from the Vue/TypeScript sources under <code>apps/</code> using Vite. To rebuild them yourself from a <code>trunk/</code> checkout:
<ol>
<li>From the plugin directory, run <code>composer install</code> to install PHP dependencies (PSR-4 autoloader + Action Scheduler).</li>
<li>Run <code>npm install</code> to install the JavaScript build dependencies declared in <code>package.json</code>.</li>
<li>Run <code>npm run build</code> to regenerate the <code>dist/</code> bundle from the <code>apps/</code> sources. For local development with hot-module replacement, run <code>npm run dev</code> (Vite dev server) after adding <code>define( 'HMR_DEV', 'nimblymail-smtp' );</code> to your <code>wp-config.php</code>.</li>
</ol>
<h4>How files under `dist/` map to readable source</h4>
Inside the SVN <code>trunk/</code>, every minified JavaScript and CSS file under <code>dist/</code> is accompanied by a <code>.map</code> source-map file (e.g. <code>dist/dashboard.<hash>.js</code> ships with <code>dist/dashboard.<hash>.js.map</code>). The source map fully describes how each minified file was produced from the readable Vue / TypeScript files under <code>apps/</code>, and any modern browser DevTools panel or build tool can use it to inspect the original source line-by-line. The high-level mapping is:
<ul>
<li><code>dist/<entry>.<hash>.js</code> — the entry-point bundle for one of the admin apps. Direct source: <code>apps/<entry>/index.ts</code> (e.g. <code>dist/dashboard.<hash>.js</code> comes from <code>apps/dashboard/index.ts</code>). Entry names are: <code>dashboard</code>, <code>settings</code>, <code>email-logs</code>, <code>queue</code>, <code>tools</code>, <code>wizard</code>, <code>deliverability</code>, <code>network-sites</code>, <code>network-dashboard</code>.</li>
<li><code>dist/chunks/<name>.<hash>.js</code> — shared chunks auto-emitted by Vite/Rollup whenever a module is imported by two or more entry points. They contain no plugin-specific code that is not also visible in the readable sources under <code>apps/</code> (and in <code>node_modules/</code> for upstream dependencies like Vue, Ant Design Vue, Vue Router, and Pinia). The <code>dist/chunks/AppHeader.<hash>.js</code> chunk in particular bundles the shared admin shell (<code>apps/shared/AppHeader.vue</code>, <code>apps/shared/theme.ts</code>, <code>apps/shared/i18n.ts</code>, the Axios HTTP client in <code>apps/shared/api.ts</code>) together with the Vue runtime and Ant Design Vue components, because every admin page imports them.</li>
<li><code>dist/assets/<name>.<hash>.css</code> — compiled CSS extracted from the corresponding Vue Single-File Components under <code>apps/</code>. Source-maps are emitted for these too (<code>*.css.map</code>).</li>
</ul>
The full version history of the plugin is also browsable on its WordPress.org page at https://wordpress.org/plugins/nimblymail-smtp/.
<h3>External services</h3>
NimblyMail does not contact any third-party service on its own. Outbound network requests only happen when you actively configure and select a mailer that uses an external provider, and only at the time of sending an email (or, for OAuth providers, when authorizing the connection).
The plugin connects to the following services depending on which mailer you choose. None of these are contacted unless you select that mailer and enter credentials.
<ul>
<li>
NimblyMail OAuth Proxy (<code>https://oauth.nimblymail.com</code>) — Used only when you choose Gmail or Outlook / Microsoft 365 as your mailer. The proxy is operated by the plugin author (NimblyMail Team) and exists so you don’t have to register your own Google Cloud project or Azure application. Endpoints contacted: <code>https://oauth.nimblymail.com/authorize/{google|microsoft}</code>, <code>https://oauth.nimblymail.com/token/{google|microsoft}</code>, <code>https://oauth.nimblymail.com/refresh/{google|microsoft}</code>, <code>https://oauth.nimblymail.com/revoke/{google|microsoft}</code>. Data sent: your site URL (<code>get_home_url()</code>), an OAuth state value and PKCE challenge generated by the plugin, the authorization code returned by Google/Microsoft after consent, the refresh token (signed with a per-install HMAC secret) on every token refresh. No email content, recipient lists, or message metadata is ever sent to the proxy — actual mail delivery goes directly from your site to Gmail’s / Microsoft’s SMTP servers. NimblyMail Terms of Service: https://nimblymail.com/terms-of-service/ — NimblyMail Privacy Policy: https://nimblymail.com/privacy-policy/
</li>
<li>
Other SMTP — When configured, every email is sent over SMTP to the server you specify (host, port, encryption, credentials). The data sent is the email itself: From / To / CC / BCC / Subject / Body / attachments. The remote SMTP server is operated by you or your provider; NimblyMail does not select it.
</li>
<li>
Gmail / Google Workspace — Uses Google’s OAuth 2.0 service (via the NimblyMail OAuth Proxy described above) to authorize sending, and <code>smtp.gmail.com:587</code> (XOAUTH2) to deliver mail. Direct endpoints contacted: <code>https://accounts.google.com/o/oauth2/v2/auth</code> (consent screen), <code>https://www.googleapis.com/oauth2/v2/userinfo</code> (read the authorized email address for the SASL <code>user=</code> field), <code>smtp.gmail.com</code> (SMTP delivery). Data sent directly to Google: the email envelope and message content at send time. Google Terms of Service: https://policies.google.com/terms — Google Privacy Policy: https://policies.google.com/privacy
</li>
<li>
Outlook / Microsoft 365 — Uses Microsoft’s OAuth 2.0 service (via the NimblyMail OAuth Proxy described above) to authorize sending, and <code>smtp.office365.com:587</code> (XOAUTH2) to deliver mail. Direct endpoints contacted: <code>https://login.microsoftonline.com/common/oauth2/v2.0/authorize</code> (consent screen), <code>https://graph.microsoft.com/v1.0/me</code> (read the authorized email address), <code>smtp.office365.com</code> (SMTP delivery). Data sent directly to Microsoft: the email envelope and message content at send time. Microsoft Services Agreement: https://www.microsoft.com/en/servicesagreement/ — Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement
</li>
<li>
Amazon SES — When configured, emails are sent over SMTP to the AWS SES endpoint you select (e.g. <code>email-smtp.us-east-1.amazonaws.com</code>). Data sent: email envelope and content, plus AWS access key ID and secret. AWS Service Terms: https://aws.amazon.com/service-terms/ — AWS Privacy Notice: https://aws.amazon.com/privacy/
</li>
<li>
Resend — When configured, emails are sent via HTTPS POST to <code>https://api.resend.com/emails</code>. Data sent: API key, email envelope and content. Resend Terms of Service: https://resend.com/legal/terms-of-service — Resend Privacy Policy: https://resend.com/legal/privacy-policy
</li>
<li>
SendLayer — When configured, emails are sent via HTTPS POST to <code>https://console.sendlayer.com/api/v1/email</code>. Data sent: API key, email envelope and content. SendLayer Terms: https://sendlayer.com/terms-of-service/ — SendLayer Privacy Policy: https://sendlayer.com/privacy-policy/
</li>
<li>
Brevo — When configured, emails are sent via HTTPS POST to <code>https://api.brevo.com/v3/smtp/email</code>. Data sent: API key, email envelope and content. Brevo Terms of Service: https://www.brevo.com/legal/termsofuse/ — Brevo Privacy Policy: https://www.brevo.com/legal/privacypolicy/
</li>
<li>
ZeptoMail — When configured, emails are sent via HTTPS POST to the regional endpoint you select (e.g. <code>https://api.zeptomail.com/v1.1/email</code>, with <code>eu</code>, <code>in</code>, <code>com.cn</code>, or <code>com.au</code> available). Data sent: Send Mail Token, email envelope and content. Zoho Terms of Service: https://www.zoho.com/zeptomail/terms.html — Zoho Privacy Policy: https://www.zoho.com/privacy.html
</li>
<li>
Default (PHP) — No external service. Emails are handed to the PHP <code>mail()</code> function and routed by your server.
</li>
</ul>
In addition, NimblyMail logs each outgoing email locally to a database table on your own WordPress site. No log data is ever transmitted off-site.
The Deliverability Health Audit performs DNS-only lookups for the configured sender domain. When the host’s PHP <code>dns_get_record()</code> is unavailable or restricted, NimblyMail falls back to public DNS-over-HTTPS resolvers (<code>https://cloudflare-dns.com/dns-query</code> and <code>https://dns.google/resolve</code>) to retrieve SPF, DKIM, DMARC, and PTR records. Only the sender domain (and DKIM selector when applicable) is sent in the query — no mail content. Cloudflare DoH Privacy: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ — Google Public DNS Privacy: https://developers.google.com/speed/public-dns/privacy

NimblyMail SMTP

A modern SMTP and email log plugin for WordPress. Improve deliverability via SMTP, Gmail, Resend, Amazon SES, or SendLayer.

Vinod Ram

VR SMTP Mailer replaces the default WordPress mail transport with SMTP or an OAuth-based mail API, with full support for Microsoft 365 (Office365), Outlook SMTP, and Microsoft Graph API.
It is designed as a complete email solution for WordPress — combining SMTP delivery, OAuth authentication, and API-based sending in a single plugin, without requiring multiple paid extensions.
<h3>Why choose this plugin</h3>
<ul>
<li>Works with Microsoft 365 / Office365 and Outlook SMTP</li>
<li>Supports both SMTP and OAuth (Graph API) in one plugin</li>
<li>No need to install multiple plugins for authentication and email delivery</li>
<li>Designed to work as a full wp_mail replacement</li>
<li>Includes features commonly available only in paid plugins</li>
<li>No subscriptions or locked features</li>
</ul>
Send emails using either SMTP or an OAuth-based mail API (Graph-compatible). 
Works with wp_mail() (for immediate sends): 
When WordPress sends emails through this plugin, it keeps the same structure as the default wp_mail() function. This includes support for multiple recipients, subject, message body, headers (From, Cc, Bcc, Reply-To, Content-Type), attachments, and inline images where supported. 
Standard WordPress filters like wp_mail, wp_mail_from, wp_mail_content_type, and phpmailer_init are applied in SMTP mode, so behavior remains consistent with native WordPress email handling. 
Graph API limitations: 
When using the Graph API, emails support HTML or plain text content, along with To, Cc, Bcc, and Reply-To fields. Attachments and inline images are supported, but typically limited to around 3 MB per file. 
Custom MIME headers are not fully supported, and only standard fields are mapped to the API. More complex email structures may behave differently compared to traditional PHP mail handling. 
Email queue (WP-Cron): 
Emails can be queued and processed later using WP-Cron. Queued emails store only basic details such as recipient, subject, and message body. Attachments, headers, and inline images are not included in queued jobs. 
Automatic OAuth token refresh: 
Access tokens are refreshed automatically to ensure uninterrupted email delivery. 
Secure OAuth handling: 
Token exchange (authorization code to access/refresh tokens) is restricted to users with administrator-level permissions (manage_options). You must be logged in as an admin when completing the OAuth connection. 
Testing tools included: 
Includes a built-in test email feature and an SMTP connection tester to help verify configuration. 
Logging and debugging: 
Email activity and debug information are stored in custom database tables for troubleshooting and monitoring.
Security and stored secrets
This plugin stores SMTP passwords, OAuth client secrets, refresh tokens, and access tokens in the WordPress options table, using the same approach as most WordPress settings. These values are not encrypted at rest.
Anyone with access to the database, a full site backup, or an administrator account could potentially view this information. It’s recommended to use strong admin credentials, secure hosting, and limit your app permissions to only what is required.
This plugin is not affiliated with or endorsed by Microsoft. Microsoft, Microsoft 365, Azure, Office, and related names are trademarks of Microsoft Corporation. These names are used only to describe compatibility and technical functionality.
Do not use Microsoft or related logos, branding, or visual assets in your plugin icon, banner, or screenshots on WordPress.org. Use your own branding and neutral visuals.
Third-party services
This plugin connects to external services only when required for email delivery or authentication. It does not send general site traffic or unrelated data to third parties.
Microsoft identity platform (OAuth2) — login.microsoftonline.com
What it is 
This is Microsoft’s OAuth2 authentication service (also known as the Microsoft Identity Platform or Entra ID). It is used when you connect your account using OAuth.
What it is used for
Signing in through Microsoft 
Exchanging authorization codes for access and refresh tokens 
Refreshing expired access tokens
What data is sent and when
During login (via browser): client ID, redirect URI, requested scopes (such as Mail.Send, User.Read), and a state parameter for security 
During token exchange (server-side): authorization code, client ID, client secret, redirect URI, grant type, and scopes
Terms 
https://www.microsoft.com/servicesagreement
Privacy 
https://privacy.microsoft.com/privacystatement
Microsoft Graph API — graph.microsoft.com
What it is 
Microsoft’s API for accessing Microsoft 365 services, including sending emails.
What it is used for 
Sending emails through the Graph API (/v1.0/me/sendMail).
What data is sent and when 
When an email is sent (including test emails), the plugin makes a secure HTTPS request that includes:
An OAuth access token 
Email details such as recipients, subject, message body, and optional Cc/Bcc/Reply-To 
Attachments or inline images (within API limits)
Terms 
https://www.microsoft.com/servicesagreement
Privacy 
https://privacy.microsoft.com/privacystatement
Note: Use of Microsoft APIs is also subject to Microsoft’s developer and product terms. Refer to https://www.microsoft.com/legal/ 
 for details.
User-configured SMTP server
What it is 
An SMTP server that you configure (for example, your hosting provider, Microsoft 365, Google Workspace, or another email service).
What it is used for 
Sending emails using your SMTP credentials.
What data is sent and when 
Whenever an email is sent (including test emails), the plugin transmits:
SMTP credentials (if configured) 
Email content such as recipients, subject, and message body
This plugin does not control or manage the infrastructure of your SMTP provider.
Terms and privacy 
You are responsible for reviewing the terms and privacy policy of your email provider. This plugin does not replace or override those agreements.

VR SMTP Mailer

SMTP or Microsoft Graph OAuth mail for WordPress. Full wp_mail replacement with logging, queue, and SMTP/email test tools.

NimblyMail SMTP vs VR SMTP Mailer