nanoPost

The WordPress Email Authority

Microsoft 365 is disabling password SMTP: what WordPress sites must do before end of 2026

Last reviewed/updated:

Something in the WordPress mail flow stopped. The contact form used to fire and doesn’t now. A client asked whether that “Microsoft is turning off password SMTP” story making the rounds is going to break the site. Or the mailer plugin’s debug log carries this exact string:

550 5.7.30 Basic authentication is not supported for Client Submission

Microsoft is switching off SMTP AUTH Basic Authentication in Exchange Online. On existing tenants the default flips off at the end of December 2026; on new tenants created after that date it will be unavailable by default. WordPress sites that authenticate to Microsoft 365 with a mailbox address and a password sit on the affected path. The path out depends on which plugin and connection type the site is using.

The timeline

  • January 27, 2026. The Exchange Team blog published the current timeline. The dates below supersede earlier revisions.
  • End of December 2026. SMTP AUTH Basic Authentication becomes disabled by default on existing Exchange Online tenants. A tenant admin can still re-enable it at tenant or mailbox scope.
  • New tenants created after December 2026. SMTP AUTH Basic Authentication will be unavailable by default; OAuth is the supported authentication method from day one.
  • Second half of 2027. Microsoft will announce the final removal date. After that date, the admin re-enable path closes.

If you saw the 5.7.30 error, you’re on the affected path

Submissions that returned the 5.7.30 string got rejected at the M365 edge and never left. Silent-mail-failure symptoms follow: contact-form notifications stop arriving, WooCommerce order receipts vanish from the inbox, password resets go unanswered. If the site’s SMTP configuration authenticates to smtp.office365.com or smtp-mail.outlook.com with a mailbox address and password, the timeline started applying whenever this string first appeared.

If you think you might be affected but aren’t

Two configurations look like the target cohort in a panic search and aren’t.

M365 SMTP relay via connector. The site sends over port 25 to <tenant>-com.mail.protection.outlook.com, and a receive connector on the tenant recognises the site’s public IP. That path does not use SMTP AUTH; the retirement does not apply. It carries its own separate constraints, though.

Direct Send. The site posts to the tenant’s MX endpoint with no authentication, and the sender address belongs to the tenant’s own domain. Also unaffected by SMTP AUTH retirement, though Direct Send’s unauthenticated model creates DMARC alignment risks and conflicts with bulk-sender thresholds at volume.

Pick your migration path

Every migration ends at one of two places: OAuth against the same M365 tenant, or a purpose-built transactional provider. Pick the spoke that names the current stack.

Identify your stack

Three questions land the reader on the right spoke. Answer them in order.

1. Is WordPress sending mail through Microsoft 365 at all? In the WordPress admin, open the SMTP plugin’s settings and look at the SMTP Host field. If it contains office365.com, outlook.com, or mail.protection.outlook.com, the answer is yes. If it contains a purpose-built provider (smtp.sendgrid.net, email-smtp.*.amazonaws.com, smtp.mailgun.org, smtp.postmarkapp.com), the SMTP AUTH retirement does not touch this site. If nothing SMTP-shaped is set, WordPress is calling PHP’s mail() function directly and the retirement does not apply. Not sure whether the domain itself sits on M365? Run the DNS auth checker against the domain. An MX record ending in mail.protection.outlook.com places the mailboxes on Microsoft 365, but WordPress can still send via a different provider than the mailbox host, so the SMTP Host field is the deciding signal.

2. Which SMTP plugin (if any) is doing the sending? Plugins → Installed Plugins in the WordPress admin lists them by name. WP Mail SMTP, FluentSMTP, and Post SMTP are the three the migration spokes above cover directly. Any other mailer plugin (WP SMTP, Easy WP SMTP, Gmail SMTP, WP Offload SES) either wraps SMTP AUTH the same way, in which case the WP Mail SMTP spoke is the closest match, or is already OAuth-only. No mailer plugin installed at all, but SMTP credentials sit in wp-config.php or an mu-plugin? The wp-config spoke covers that case.

3. Password authentication, or OAuth? In WP Mail SMTP, “Other SMTP” mailer with the SMTP Password field populated is password auth; the “Outlook” mailer (WP Mail SMTP Pro’s one-click Microsoft app) is OAuth. In FluentSMTP, a “Generic SMTP” connection with an Auth Type of User/Password is password auth; the “Office 365” driver is OAuth. In Post SMTP, “SMTP” transport with a password is password auth; the “Outlook OAuth2” transport is OAuth. Password-auth combinations pick the migration spoke above. OAuth combinations remain on the OAuth setup guide and are not touched by this retirement.

Once the three questions are answered, the spoke above with the matching plugin name is the migration path. The WordPress SMTP with Microsoft 365 setup guide carries the full plugin-choice table for readers who want to see every combination side by side.

Related coverage

Changelog

  • 2026-08-02. Hub published. Reflects Microsoft’s January 27, 2026 revised timeline; the 2027 removal-date announcement is pending, verified: re-review triggers on that announcement.
  • 2026-08-02 (revision). Identify-your-stack section rewritten as a self-contained three-question triage (Am I on M365? Which plugin? Password or OAuth?) rather than a forward-reference to a diagnostic tool. The tool remains a candidate for a later revision; the triage stands on its own for now.