Microsoft 365 is a common SMTP relay for WordPress sites in organisations already using it for business email. It works, but the configuration has specific requirements — and the error messages when something is wrong are specific enough that you can diagnose them precisely.
The two relay methods
SMTP AUTH submission (smtp.office365.com, port 587, STARTTLS) requires per-account authentication. The account used for sending must have SMTP AUTH enabled. This is the method WordPress mailer plugins use.
Direct Send (your server’s IP, port 25) requires no authentication but only delivers to recipients whose mailboxes are in your own M365 tenant. It cannot relay to external addresses. This is documented by Microsoft and enforced at the tenant edge — if you try to send external email via Direct Send, you get 550 5.7.30.
SMTP AUTH requirements
Modern Auth tenants have SMTP AUTH disabled by default since 2023. To send WordPress email via M365:
- Go to Microsoft 365 Admin Centre → Users → Active users.
- Select the account used for SMTP sending.
- Under Mail tab → Manage email apps, enable Authenticated SMTP.
Or, use WP Mail SMTP Pro or FluentSMTP with OAuth2, which uses Modern Auth and doesn’t require SMTP AUTH to be enabled per account.
Common errors and what they mean
550 5.7.515 — SMTP AUTH is disabled on the account. Enable it per the steps above, or switch to OAuth2.
550 5.7.30 — You’re using Direct Send and trying to send to an external recipient. Switch to SMTP AUTH submission.
550 5.7.350 — Your message was blocked by a mail flow rule in the recipient’s tenant. This is a policy on their end; contact their IT department.
Read next
SPF for M365 relay
When sending via smtp.office365.com, include Microsoft’s SPF in your domain’s TXT record:
include:spf.protection.outlook.comWithout this, receiving servers may reject your mail as coming from an unauthorised server.
DKIM for M365
Microsoft 365 can sign outbound messages with DKIM on your behalf. Enable this in the Microsoft 365 Defender portal (or Exchange Admin Centre) under Email & Collaboration → Policies & Rules → Threat policies → DKIM. You’ll add two CNAME records to DNS pointing to Microsoft’s signing infrastructure.
Port summary
| Port | Protocol | Use |
|---|---|---|
| 587 | STARTTLS | Recommended for authenticated submission |
| 465 | SMTPS | Deprecated by RFC; some clients still use it |
| 25 | Plain | Direct Send only; blocked by most hosting providers |
Read next
Related
- SMTP Error Decoder — paste 550 5.7.515, 550 5.7.30, or 550 5.7.350 for a targeted fix
- Microsoft 365 sending service review
- SPF for WordPress