Something in the WordPress mail flow stopped. The contact form used to fire and doesn’t now. A client asked whether that “Microsoft is turning off password SMTP” story making the rounds is going to break the site. Or the mailer plugin’s debug log carries this exact string:
550 5.7.30 Basic authentication is not supported for Client SubmissionMicrosoft is switching off SMTP AUTH Basic Authentication in Exchange Online. On existing tenants the default flips off at the end of December 2026; on new tenants created after that date it will be unavailable by default. WordPress sites that authenticate to Microsoft 365 with a mailbox address and a password sit on the affected path. The path out depends on which plugin and connection type the site is using.
The timeline
- January 27, 2026. The Exchange Team blog
published the current timeline. The dates below supersede earlier revisions. - End of December 2026. SMTP AUTH Basic Authentication becomes disabled by default on existing Exchange Online tenants. A tenant admin can still re-enable it at tenant or mailbox scope.
- New tenants created after December 2026. SMTP AUTH Basic Authentication will be unavailable by default; OAuth is the supported authentication method from day one.
- Second half of 2027. Microsoft will announce the final removal date. After that date, the admin re-enable path closes.
If you saw the 5.7.30 error, you’re on the affected path
Submissions that returned the 5.7.30 string got rejected at the M365 edge and never left. Silent-mail-failure symptoms follow: contact-form notifications stop arriving, WooCommerce order receipts vanish from the inbox, password resets go unanswered. If the site’s SMTP configuration authenticates to smtp.office365.com or smtp-mail.outlook.com with a mailbox address and password, the timeline started applying whenever this string first appeared.
If you think you might be affected but aren’t
Two configurations look like the target cohort in a panic search and aren’t.
M365 SMTP relay via connector. The site sends over port 25 to <tenant>-com.mail.protection.outlook.com, and a receive connector on the tenant recognises the site’s public IP. That path does not use SMTP AUTH; the retirement does not apply. It carries its own separate constraints, though.
Direct Send. The site posts to the tenant’s MX endpoint with no authentication, and the sender address belongs to the tenant’s own domain. Also unaffected by SMTP AUTH retirement, though Direct Send’s unauthenticated model creates DMARC alignment risks and conflicts with bulk-sender thresholds at volume.
Pick your migration path
Every migration ends at one of two places: OAuth against the same M365 tenant, or a purpose-built transactional provider. Pick the spoke that names the current stack.
- WP Mail SMTP with the Other SMTP mailer, M365 mailbox + password. WP Mail SMTP + Microsoft 365 migration.
- FluentSMTP with a Generic SMTP connection to
smtp.office365.com. FluentSMTP + Microsoft 365 migration. - Post SMTP with an SMTP transport and a password. Post SMTP + Microsoft 365 migration.
wp_mail()with SMTP credentials inwp-config.phpand no mailer plugin. SMTP in wp-config + Microsoft 365 migration.- M365 SMTP relay via connector, or Direct Send. Microsoft 365 SMTP relay and Direct Send. Read it even if you’re confident this isn’t you; connector relay is misidentified more often than it’s correctly identified on first pass.
- None of the above. The plugin-choice table below identifies the right spoke.
Identify your stack
Three questions land the reader on the right spoke. Answer them in order.
1. Is WordPress sending mail through Microsoft 365 at all? In the WordPress admin, open the SMTP plugin’s settings and look at the SMTP Host field. If it contains office365.com, outlook.com, or mail.protection.outlook.com, the answer is yes. If it contains a purpose-built provider (smtp.sendgrid.net, email-smtp.*.amazonaws.com, smtp.mailgun.org, smtp.postmarkapp.com), the SMTP AUTH retirement does not touch this site. If nothing SMTP-shaped is set, WordPress is calling PHP’s mail() function directly and the retirement does not apply. Not sure whether the domain itself sits on M365? Run the DNS auth checker against the domain. An MX record ending in mail.protection.outlook.com places the mailboxes on Microsoft 365, but WordPress can still send via a different provider than the mailbox host, so the SMTP Host field is the deciding signal.
2. Which SMTP plugin (if any) is doing the sending? Plugins → Installed Plugins in the WordPress admin lists them by name. WP Mail SMTP, FluentSMTP, and Post SMTP are the three the migration spokes above cover directly. Any other mailer plugin (WP SMTP, Easy WP SMTP, Gmail SMTP, WP Offload SES) either wraps SMTP AUTH the same way, in which case the WP Mail SMTP spoke is the closest match, or is already OAuth-only. No mailer plugin installed at all, but SMTP credentials sit in wp-config.php or an mu-plugin? The wp-config spoke covers that case.
3. Password authentication, or OAuth? In WP Mail SMTP, “Other SMTP” mailer with the SMTP Password field populated is password auth; the “Outlook” mailer (WP Mail SMTP Pro’s one-click Microsoft app) is OAuth. In FluentSMTP, a “Generic SMTP” connection with an Auth Type of User/Password is password auth; the “Office 365” driver is OAuth. In Post SMTP, “SMTP” transport with a password is password auth; the “Outlook OAuth2” transport is OAuth. Password-auth combinations pick the migration spoke above. OAuth combinations remain on the OAuth setup guide and are not touched by this retirement.
Once the three questions are answered, the spoke above with the matching plugin name is the migration path. The WordPress SMTP with Microsoft 365 setup guide carries the full plugin-choice table for readers who want to see every combination side by side.
Related coverage
- WordPress SMTP with Microsoft 365. The evergreen OAuth setup guide, and the destination the migration spokes converge on.
- Microsoft 365 as a WordPress SMTP server. The entity review, for readers reconsidering M365 as the sender at all.
- SMTP services for WordPress. The sending-service directory. Postmark, SMTP2GO, Mailgun, and SendGrid are the four the spokes route toward most often.
Changelog
- 2026-08-02. Hub published. Reflects Microsoft’s January 27, 2026 revised timeline; the 2027 removal-date announcement is pending,
verified:re-review triggers on that announcement. - 2026-08-02 (revision). Identify-your-stack section rewritten as a self-contained three-question triage (Am I on M365? Which plugin? Password or OAuth?) rather than a forward-reference to a diagnostic tool. The tool remains a candidate for a later revision; the triage stands on its own for now.