WordPress Email Reference

The recurring concepts behind WordPress email: the five-stage delivery chain from wp_mail() to the recipient’s mail server, what actually happened when Google’s Less Secure App access shut down, when a queue earns its keep and when it just adds a moving part, what a webhook is worth over a bounce log, and what an SMTP bounce code is really telling you. One entry per concept, kept current as the underlying pieces move.

Start here

Read How Email Works first. It maps the five-stage delivery chain (wp_mail() → PHPMailer → transport → relay → recipient mail server), and every other entry on this page assumes you already know which stage a decision belongs to. If you’ve arrived after a delivery failure and want the mental model before the fix, this is the one to open.

How Email Works: A WordPress Operator’s Reference

The five-stage delivery chain from wp_mail() to inbox, what the operator controls, and how SPF, DKIM, and DMARC work as a system.
Read More: How Email Works: A WordPress Operator’s Reference

All references

ARC for forwarded WordPress mail: what the chain is and who trusts it

ARC is the forwarder’s cryptographically signed record of what pre-forward authentication looked like. A receiver that trusts the forwarder can accept its attestation that SPF and DKIM passed before the hop, even when the current authentication state has broken on the forward.
Debugging WordPress SMTP OAuth setups with Postman

Validate a Microsoft 365 or Google Workspace OAuth registration in Postman before wiring the client ID and secret into WP Mail SMTP, FluentSMTP, or Post SMTP.
DKIM for WordPress email: how the signature works and how it fails

DKIM is the cryptographic signature a sending server attaches to each outgoing message, verifiable against a public key published in DNS. For WordPress operators, it is the authentication method that survives forwarding and the one that carries DMARC alignment through most relay configurations.
DMARC for WordPress email: policy, alignment, and reports

DMARC is the DNS record that tells receivers what to do with mail that fails SPF or DKIM, and where to send reports about the failures. For WordPress sites, it is also the record Gmail and Yahoo now require.
Email service webhooks in WordPress: events, verification, retries

How ESP delivery-status webhooks work in WordPress: what Postmark, Mailgun, SendGrid, SES and Mailjet send, how to receive them, and how to verify them.
Every Email WordPress Core Sends: the wp_mail catalog

The catalog of transactional emails WordPress core sends — comments, password resets, GDPR, updates, recovery mode — with trigger, default recipients, and the filters that control each one.
Free and unauthenticated SMTP servers in 2026

What free SMTP servers still exist in 2026, why unauthenticated SMTP no longer reaches inboxes at Gmail and Microsoft 365, and what a WordPress site can use.
Less Secure App access: what replaced it, when it shut down, and what to do now

Google shut down Less Secure App access — consumer Gmail May 2022, Workspace May 2025. The three replacements (OAuth, App Password, switch provider) and which fits which WordPress use case.
Reading SMTP bounce codes in WordPress mailer logs

Decoding the SMTP bounce codes WP Mail SMTP, FluentSMTP, and Post SMTP log – numeric code, enhanced status code, and Gmail/M365 variations.
SPF for WordPress email: what the record does and how it fails

SPF is the DNS TXT record that lists the servers allowed to send mail from your domain. Receivers check the sending IP against the list, and the record is where WordPress operators tell Gmail and Outlook which relay the site uses.
SRS for forwarded WordPress mail: what the scheme does and where it stops

SRS rewrites the envelope sender during a forwarding hop so SPF realigns at the destination against the forwarder’s own domain. For WordPress operators, it is the fix that keeps forwarded inbound mail from silently failing when the original sender publishes a strict DMARC policy.
Transactional email and WordPress

Transactional email goes to one recipient following one action they initiated. Here is what WordPress core and WooCommerce send, and how the legal carve-out works.
Troubleshooting WordPress email: a reference

WordPress email breaks at one of four stages in the delivery chain. The symptom (silent send, bounce, spam placement) does not tell you which stage. The diagnostic method is to find the stage first.
WordPress Email Queues: When You Need One and When You Don’t

wp_mail() sends email synchronously – every call blocks the PHP process until SMTP completes. A queue decouples sending from the page request. Here’s when that matters.
WordPress.com vs WordPress.org Email: Who Owns the Sending Pipeline

On WordPress.com, Automattic owns wp_mail’s transport and the sending domain. On self-hosted WordPress.org, the operator owns both. Every email-behaviour difference between the two platforms follows from that.