The WordPress Email Authority
Definitions for WordPress email infrastructure: DMARC alignment, SPF flattening, the wp_mail pipeline, app passwords versus OAuth, the components of authentication and what each one actually checks. Each entry settles one term.
wp_mail() sends email synchronously – every call blocks the PHP process until SMTP completes. A queue decouples sending from the page request. Here’s when that matters.

Decoding the SMTP bounce codes WP Mail SMTP, FluentSMTP, and Post SMTP log – numeric code, enhanced status code, and Gmail/M365 variations.
Validate a Microsoft 365 or Google Workspace OAuth registration in Postman before wiring the client ID and secret into WP Mail SMTP, FluentSMTP, or Post SMTP.
How ESP delivery-status webhooks work in WordPress: what Postmark, Mailgun, SendGrid, SES and Mailjet send, how to receive them, and how to verify them.
The five-stage delivery chain from wp_mail() to inbox, what the operator controls, and how SPF, DKIM, and DMARC work as a system.
On WordPress.com, Automattic owns wp_mail’s transport and the sending domain. On self-hosted WordPress.org, the operator owns both. Every email-behaviour difference between the two platforms follows from that.
The catalog of transactional emails WordPress core sends — comments, password resets, GDPR, updates, recovery mode — with trigger, default recipients, and the filters that control each one.
Google shut down Less Secure App access — consumer Gmail May 2022, Workspace May 2025. The three replacements (OAuth, App Password, switch provider) and which fits which WordPress use case.
Transactional email goes to one recipient following one action they initiated. Here is what WordPress core and WooCommerce send, and how the legal carve-out works.