Title: NimblyMail SMTP – SMTP, Gmail, Outlook & Amazon SES Email Log and Deliverability Plugin
Author: NimblyMail
Published: 5. Juni 2026
Last modified: 28. September 2026
---
Search plugins
# NimblyMail SMTP – SMTP, Gmail, Outlook & Amazon SES Email Log and Deliverability Plugin
By [NimblyMail](https://profiles.wordpress.org/nimblymail/)
[Download](https://downloads.wordpress.org/plugin/nimblymail-smtp.1.1.0.zip)
* [Details](https://de-ch.wordpress.org/plugins/nimblymail-smtp/#description)
* [Reviews](https://de-ch.wordpress.org/plugins/nimblymail-smtp/#reviews)
* [Installation](https://de-ch.wordpress.org/plugins/nimblymail-smtp/#installation)
* [Development](https://de-ch.wordpress.org/plugins/nimblymail-smtp/#developers)
[Support](https://wordpress.org/support/plugin/nimblymail-smtp/)
## Description
NimblyMail is a comprehensive SMTP and email logging plugin designed to fix WordPress
email deliverability issues. By default, WordPress uses the unreliable PHP `mail()`
function, which often causes emails to land in the spam folder or never deliver.
NimblyMail solves this by reconfiguring WordPress to securely route your site’s
emails through a proper SMTP server or dedicated email provider.
Whether you need to connect via a standard SMTP host, Gmail OAuth, Microsoft 365
OAuth, Amazon SES, Resend, SendLayer, Brevo, or ZeptoMail, NimblyMail ensures your
emails reach the inbox. Plus, with comprehensive email logging, a background queue,
a developer sandbox, and an automated deliverability audit, you get full delivery
monitoring and one-click troubleshooting.
#### At a glance
* Nine email providers — SMTP, Gmail OAuth, Outlook / Microsoft 365 OAuth, Amazon
SES, Resend, SendLayer, Brevo, ZeptoMail, and PHP mail.
* **Free Email Logging** — Comprehensive log with search, status filters, and one-
click resend of failed emails.
* **Background Queue** — Defer wp_mail() calls to a non-blocking queue powered
by Action Scheduler, with three-tier priority, exponential backoff retries, and
admin tools to retry or cancel pending mail.
* **Developer Sandbox** — Stop staging and local environments from sending real
email. Choose Log Only (capture and short-circuit) or Redirect (rewrite every
recipient to a single safe address). Optional allowlist for addresses that should
bypass the sandbox.
* **Deliverability Health Audit** — Automated DNS-based audit of SPF, DKIM, DMARC,
and PTR for the active sender domain, with scheduled checks and human-readable
findings per pillar.
* **Clean, Modern Dashboard** — Delivery stats, connection health, queue health
widget, deliverability summary, and recent activity at a glance.
* Selectively disable WordPress notification emails across 8 categories (over 25
individual triggers).
* Failure alerts delivered via PHP’s native `mail()` so a broken transport can’t
silence them.
* AES-256-CBC credential encryption with optional PHP-constant overrides in wp-
config.php.
* First-class WordPress Multisite support with network defaults, per-site overrides,
and per-field locks.
* Guided setup wizard with auto-detection and one-click import from existing SMTP
plugins.
#### Supported Email Providers
* **Other SMTP** — Connect to any SMTP server (Outlook, Office 365, Mailgun, SendGrid,
Zoho, etc.)
* **Gmail / Google Workspace** — Authenticate via Google OAuth using your own Google
Cloud OAuth client (Client ID and Client Secret).
* **Outlook / Microsoft 365** — Authenticate via Microsoft OAuth using your own
Azure app registration (Application ID and Client Secret) and send through `smtp.
office365.com`.
* **Amazon SES** — Send via AWS Simple Email Service
* **Resend** — Modern email API for developers
* **SendLayer** — Transactional email delivery service
* **Brevo** — Transactional email API (formerly Sendinblue)
* **ZeptoMail** — Zoho’s transactional email service with regional endpoints
* **Default (PHP)** — Fallback to the built-in PHP mail function
#### Email Logging
Every outgoing email is logged with recipient, subject, status, headers, and optional
body capture. Search and filter logs by status (sent, failed, pending), resend failed
emails with one click, and view full message details in a modal preview.
#### Background Queue
Turn the queue on under NimblyMail > Settings > Mail Queue and every wp_mail() call
returns immediately. Messages are persisted to a database queue, dispatched by Action
Scheduler in priority order (high / normal / bulk), and retried with exponential
backoff on transient failures. Attachments are staged on enqueue so request-scoped
tmp files cannot break delayed delivery. The Queue admin screen lists pending and
failed items with retry / cancel actions, and the dashboard surfaces a queue-health
widget. Test emails and admin alerts continue to send synchronously by default so
you always get immediate feedback.
#### Developer Sandbox
Working on a staging copy or local clone? Turn on the sandbox to guarantee no real
customer ever receives an accidental email. Pick **Log Only** to capture and short-
circuit every wp_mail() call so they show up in the Email Log without leaving the
host, or **Redirect** to rewrite every recipient to a single safe address with the
originals preserved in `X-NimblyMail-Original-*` headers and a configurable subject
prefix. An allowlist (exact email or `*@domain.com`) lets through addresses you
do want delivered for testing. Sandboxing is settings-driven, switchable from the
Network Admin on multisite, and visible at a glance via an admin-bar badge.
#### Deliverability Health Audit
NimblyMail runs an automated DNS audit of the active sender domain on a schedule(
and on demand) and surfaces the result on the Deliverability page and the dashboard.
The audit covers four pillars — SPF, DKIM, DMARC, and PTR — and is mailer-aware:
required SPF includes and DKIM selectors are sourced from whichever provider you
have configured (Gmail, Outlook 365, SES, etc.), with skip explanations for cases
where a check does not apply. Findings are human-readable: each pillar shows pass/
warn/fail with a one-line reason and a link to the relevant provider documentation.
#### Email Controls
Selectively disable WordPress notification emails you don’t need — comment notifications,
password reset emails, new user registrations, automatic update notices, and more.
Over 25 individual email types across 8 categories can be toggled on or off.
#### Failure Alerts
Receive instant alerts when emails fail to deliver. Configure alert recipients with
optional CC and BCC addresses. Alerts are sent via PHP’s native mail function to
bypass the broken transport.
#### Security
Credentials (SMTP passwords, API keys) are encrypted at rest using AES-256-CBC with
HMAC-SHA256 verification. Settings can be locked via PHP constants in wp-config.
php, making sensitive fields read-only in the admin UI.
#### Settings Import
Migrating from another SMTP plugin? NimblyMail automatically detects existing SMTP-
plugin configurations and offers one-click import through the setup wizard.
#### WordPress Multisite
First-class multisite support. Network-activate the plugin once and every sub-site
inherits the network defaults until a site admin explicitly overrides a field. Super
admins get a Network Admin NimblyMail surface with an aggregated dashboard, a sites
table, per-field locks, and a per-site override editor.
#### Clean Dashboard
Built with Vue 3 and Ant Design, the dashboard is fast, responsive, and designed
to feel native to WordPress. A guided setup wizard helps you configure everything
in minutes, while the main dashboard provides a clear overview of your email delivery
health.
#### Usage Tracking
Off by default. If you opt in under NimblyMail > Settings, NimblyMail periodically
sends anonymous, aggregated data about your configuration and email volume — never
email content, recipients, or credentials — to help prioritize development. Turn
it off any time in Settings, or permanently with the `NIMBLYMAIL_TELEMETRY_DISABLED`
constant. See External services below for full details.
### Development and source code
The complete, human-readable source code for NimblyMail is maintained in the public
WordPress.org SVN repository for this plugin. Browse it directly in your web browser
via the Trac UI:
* **Browse source:** https://plugins.trac.wordpress.org/browser/nimblymail-smtp/
trunk/
* **SVN checkout:** `svn checkout https://plugins.svn.wordpress.org/nimblymail-
smtp/trunk/ nimblymail-smtp`
The repository `trunk/` directory contains:
* `src/` — the PHP backend (PSR-4 autoloaded, plain readable PHP).
* `apps/` — the Vue 3 + TypeScript single-page apps (Dashboard, Settings, Email
Logs, Tools, Setup Wizard, Network Admin) that get compiled into the minified
bundles under `dist/`.
* `package.json`, `package-lock.json`, `tsconfig.json`, `tsconfig.node.json`, `
vite.config.ts` — the build configuration needed to reproduce the exact `dist/`
bundles.
* The current `dist/` build output plus per-bundle source-map files (`*.js.map`,`*.
css.map`).
The minified JavaScript and CSS files under `dist/` are produced from the Vue/TypeScript
sources under `apps/` using Vite. To rebuild them yourself from a `trunk/` checkout:
1. From the plugin directory, run `composer install` to install PHP dependencies (
PSR-4 autoloader + Action Scheduler).
2. Run `npm install` to install the JavaScript build dependencies declared in `package.
json`.
3. Run `npm run build` to regenerate the `dist/` bundle from the `apps/` sources.
For local development with hot-module replacement, run `npm run dev` (Vite dev
server) after adding `define( 'HMR_DEV', 'nimblymail-smtp' );` to your `wp-config.
php`.
#### How files under `dist/` map to readable source
Inside the SVN `trunk/`, every minified JavaScript and CSS file under `dist/` is
accompanied by a `.map` source-map file (e.g. `dist/dashboard..js` ships with`
dist/dashboard..js.map`). The source map fully describes how each minified
file was produced from the readable Vue / TypeScript files under `apps/`, and any
modern browser DevTools panel or build tool can use it to inspect the original source
line-by-line. The high-level mapping is:
* `dist/..js` — the entry-point bundle for one of the admin apps.
Direct source: `apps//index.ts` (e.g. `dist/dashboard..js` comes
from `apps/dashboard/index.ts`). Entry names are: `dashboard`, `settings`, `email-
logs`, `queue`, `tools`, `wizard`, `deliverability`, `network-sites`, `network-
dashboard`.
* `dist/chunks/..js` — shared chunks auto-emitted by Vite/Rollup whenever
a module is imported by two or more entry points. They contain no plugin-specific
code that is not also visible in the readable sources under `apps/` (and in `
node_modules/` for upstream dependencies like Vue, Ant Design Vue, Vue Router,
and Pinia). The `dist/chunks/AppHeader..js` chunk in particular bundles
the shared admin shell (`apps/shared/AppHeader.vue`, `apps/shared/theme.ts`, `
apps/shared/i18n.ts`, the Axios HTTP client in `apps/shared/api.ts`) together
with the Vue runtime and Ant Design Vue components, because every admin page
imports them.
* `dist/assets/..css` — compiled CSS extracted from the corresponding
Vue Single-File Components under `apps/`. Source-maps are emitted for these too(`*.
css.map`).
The full version history of the plugin is also browsable on its WordPress.org page
at https://wordpress.org/plugins/nimblymail-smtp/.
### External services
NimblyMail does not contact any third-party service on its own. Outbound network
requests only happen when **you actively configure and select a mailer** that uses
an external provider, and only at the time of sending an email (or, for OAuth providers,
when authorizing the connection).
The plugin connects to the following services depending on which mailer you choose.
None of these are contacted unless you select that mailer and enter credentials.
* **NimblyMail OAuth Proxy** (`https://oauth.nimblymail.com`) — A hosted OAuth
service operated by the plugin author (NimblyMail Team). It is **not used by
default and is not currently offered**: Gmail and Outlook / Microsoft 365 connect
directly to Google and Microsoft with your own OAuth app (see below). The plugin
only contacts the proxy if a site has been explicitly switched to the hosted
method (for example via the `NIMBLYMAIL_GMAIL_AUTH_METHOD` or `NIMBLYMAIL_OUTLOOK_AUTH_METHOD`
constants) and then only at `https://oauth.nimblymail.com/token/{google|microsoft}`,`
https://oauth.nimblymail.com/refresh/{google|microsoft}` and `https://oauth.nimblymail.
com/revoke/{google|microsoft}`, plus the `authorize/{google|microsoft}` page
your browser is sent to. **Data sent**: your site URL (`get_home_url()`), the
URL of your NimblyMail settings page in wp-admin (as the callback), an OAuth
state value and nonce generated by the plugin, the authorization code returned
by Google/Microsoft after consent, the install identifier issued by the proxy,
and the refresh token (signed with a per-install HMAC secret) on every token
refresh. **No email content, recipient lists, or message metadata is ever sent
to the proxy.** NimblyMail Terms of Service: https://nimblymail.com/terms-of-
service/ — NimblyMail Privacy Policy: https://nimblymail.com/privacy-policy/
* **Other SMTP** — When configured, every email is sent over SMTP to the server
you specify (host, port, encryption, credentials). The data sent is the email
itself: From / To / CC / BCC / Subject / Body / attachments. The remote SMTP
server is operated by you or your provider; NimblyMail does not select it.
* **Gmail / Google Workspace** — Uses Google’s OAuth 2.0 service with the Client
ID and Client Secret of your own Google Cloud project to authorize sending, and`
smtp.gmail.com:587` (XOAUTH2) to deliver mail. Endpoints contacted: `https://
accounts.google.com/o/oauth2/v2/auth` (consent screen, opened in your browser),`
https://oauth2.googleapis.com/token` (exchange the authorization code and refresh
the access token), `https://oauth2.googleapis.com/revoke` (revoke the grant when
you disconnect), `https://www.googleapis.com/oauth2/v2/userinfo` (read the authorized
email address for the SASL `user=` field), `smtp.gmail.com` (SMTP delivery).
Data sent to Google: your Client ID and Client Secret, the authorization code,
and the refresh or access token at the token and revoke endpoints; the email
envelope and message content at send time. Google API Services Terms: https://
developers.google.com/terms — Google Privacy Policy: https://policies.google.
com/privacy
* **Outlook / Microsoft 365** — Uses Microsoft’s OAuth 2.0 service with the client
ID and client secret of your own Azure app registration to authorize sending,
and `smtp.office365.com:587` (XOAUTH2) to deliver mail. Endpoints contacted: `
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize` (consent screen,
opened in your browser) and `https://login.microsoftonline.com/{tenant}/oauth2/
v2.0/token` (exchange the authorization code and refresh the access token), where`{
tenant}` is the tenant you configure (`common` by default), `https://graph.microsoft.
com/v1.0/me` (read the authorized email address), `smtp.office365.com` (SMTP
delivery). Microsoft offers no token-revoke endpoint, so disconnecting only clears
the tokens stored on your site. Data sent to Microsoft: your client ID and client
secret, the authorization code, and the refresh token at the token endpoint;
the email envelope and message content at send time. Microsoft Services Agreement:
https://www.microsoft.com/servicesagreement — Microsoft Privacy Statement: https://
privacy.microsoft.com/privacystatement
* **Amazon SES** — When configured, emails are sent over SMTP to the AWS SES endpoint
you select (e.g. `email-smtp.us-east-1.amazonaws.com`). Data sent: email envelope
and content, plus AWS access key ID and secret. AWS Service Terms: https://aws.
amazon.com/service-terms/ — AWS Privacy Notice: https://aws.amazon.com/privacy/
* **Resend** — When configured, emails are sent via HTTPS POST to `https://api.
resend.com/emails`. Data sent: API key, email envelope and content. Resend Terms
of Service: https://resend.com/legal/terms-of-service — Resend Privacy Policy:
https://resend.com/legal/privacy-policy
* **SendLayer** — When configured, emails are sent via HTTPS POST to `https://api.
sendlayer.com/v1/emails`. Data sent: API key, email envelope and content. SendLayer
Terms: https://sendlayer.com/terms-of-service/ — SendLayer Privacy Policy: https://
sendlayer.com/privacy-policy/
* **Brevo** — When configured, emails are sent via HTTPS POST to `https://api.brevo.
com/v3/smtp/email`. Data sent: API key, email envelope and content. Brevo Terms
of Service: https://www.brevo.com/legal/termsofuse/ — Brevo Privacy Policy: https://
www.brevo.com/legal/privacypolicy/
* **ZeptoMail** — When configured, emails are sent via HTTPS POST to the regional
endpoint you select (e.g. `https://api.zeptomail.com/v1.1/email`, with `eu`, `
in`, `com.cn`, or `com.au` available). Data sent: Send Mail Token, email envelope
and content. Zoho Terms of Service: https://www.zoho.com/zeptomail/terms.html—
Zoho Privacy Policy: https://www.zoho.com/privacy.html
* **Default (PHP)** — No external service. Emails are handed to the PHP `mail()`
function and routed by your server.
In addition, NimblyMail logs each outgoing email **locally** to a database table
on your own WordPress site. No log data is ever transmitted off-site.
The Deliverability Health Audit performs DNS-only lookups for the configured sender
domain. When the host’s PHP `dns_get_record()` is unavailable or restricted, NimblyMail
falls back to public DNS-over-HTTPS resolvers (`https://cloudflare-dns.com/dns-query`
and `https://dns.google/resolve`) to retrieve SPF, DKIM, DMARC, and PTR records.
Only the sender domain (and DKIM selector when applicable) is sent in the query —
no mail content. The audit’s connectivity check also opens a plain connection or
sends an empty HEAD request to the endpoints of your active mailer only (the hosts
listed above); no email content or credentials are sent. Cloudflare DoH Privacy:
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ — Google
Public DNS Privacy: https://developers.google.com/speed/public-dns/privacy
* **NimblyMail Usage Tracking** (`https://stats.nimblymail.com`) — **Opt-in only,
off by default.** Not contacted unless you explicitly turn it on under NimblyMail
> Settings. On first opt-in, the plugin registers with the service and receives
a random install identifier and a matching installation credential, stored locally;
every later report or event is signed with that credential so the service can
tell it actually came from this install. NimblyMail then sends a periodic report
roughly once a week, plus a small event at activation, deactivation, upgrade,
and when you grant consent. **Data sent**: the install identifier and its signature,
environment details (WordPress, PHP, database, and web-server versions, locale,
timezone, environment type), which mailer …
## Screenshots
[⌊Dashboard — Delivery stats, connection status, queue health, deliverability summary,
and recent email activity at a glance.⌉⌊Dashboard — Delivery stats, connection status,
queue health, deliverability summary, and recent email activity at a glance.⌉[
Dashboard — Delivery stats, connection status, queue health, deliverability summary,
and recent email activity at a glance.
[⌊Email Log — Searchable log table with status filters, bulk actions, and per-email
detail view.⌉⌊Email Log — Searchable log table with status filters, bulk actions,
and per-email detail view.⌉[
Email Log — Searchable log table with status filters, bulk actions, and per-email
detail view.
[⌊Settings: Connection — Choose from nine supported mailers including Gmail OAuth,
Outlook / Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, and ZeptoMail.⌉⌊
Settings: Connection — Choose from nine supported mailers including Gmail OAuth,
Outlook / Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, and ZeptoMail
.⌉[
Settings: Connection — Choose from nine supported mailers including Gmail OAuth,
Outlook / Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, and ZeptoMail.
[⌊Settings: Connection (Outlook / Microsoft 365) — Connect your Microsoft account
using your own Azure app registration: enter the client ID and secret, copy the
redirect URI, and authorize.⌉⌊Settings: Connection (Outlook / Microsoft 365) — Connect
your Microsoft account using your own Azure app registration: enter the client ID
and secret, copy the redirect URI, and authorize.⌉[
Settings: Connection (Outlook / Microsoft 365) — Connect your Microsoft account
using your own Azure app registration: enter the client ID and secret, copy the
redirect URI, and authorize.
[⌊Setup Wizard — Guided first-run configuration with auto-detection of existing
SMTP plugins.⌉⌊Setup Wizard — Guided first-run configuration with auto-detection
of existing SMTP plugins.⌉[
Setup Wizard — Guided first-run configuration with auto-detection of existing SMTP
plugins.
[⌊Settings: Mail Queue — Turn on the background queue to defer wp_mail() calls;
configure max attempts, batch size, exponential backoff, default priority, and a
pause toggle.⌉⌊Settings: Mail Queue — Turn on the background queue to defer wp_mail()
calls; configure max attempts, batch size, exponential backoff, default priority,
and a pause toggle.⌉[
Settings: Mail Queue — Turn on the background queue to defer wp_mail() calls; configure
max attempts, batch size, exponential backoff, default priority, and a pause toggle.
[⌊Mail Queue admin — Live view of pending, processing, and failed deliveries with
per-row retry / cancel actions, last-error preview, and counts grouped by status.⌉⌊
Mail Queue admin — Live view of pending, processing, and failed deliveries with
per-row retry / cancel actions, last-error preview, and counts grouped by status
.⌉[
Mail Queue admin — Live view of pending, processing, and failed deliveries with
per-row retry / cancel actions, last-error preview, and counts grouped by status.
[⌊Settings: Developer Sandbox — Stop staging environments from sending real email.
Log Only or Redirect mode, with an allowlist for addresses that should still be
delivered.⌉⌊Settings: Developer Sandbox — Stop staging environments from sending
real email. Log Only or Redirect mode, with an allowlist for addresses that should
still be delivered.⌉[
Settings: Developer Sandbox — Stop staging environments from sending real email.
Log Only or Redirect mode, with an allowlist for addresses that should still be
delivered.
[⌊Deliverability Health Audit — Automated SPF / DKIM / DMARC / PTR audit of the
active sender domain with mailer-aware requirements.⌉⌊Deliverability Health Audit—
Automated SPF / DKIM / DMARC / PTR audit of the active sender domain with mailer-
aware requirements.⌉[
Deliverability Health Audit — Automated SPF / DKIM / DMARC / PTR audit of the active
sender domain with mailer-aware requirements.
[⌊Tools: Email Tester — Send a test email to verify your configuration works.⌉⌊Tools:
Email Tester — Send a test email to verify your configuration works.⌉[
Tools: Email Tester — Send a test email to verify your configuration works.
[⌊Settings: Email Controls — Toggle individual WordPress notification emails on
or off (over 25 triggers across 8 categories).⌉⌊Settings: Email Controls — Toggle
individual WordPress notification emails on or off (over 25 triggers across 8 categories)
.⌉[
Settings: Email Controls — Toggle individual WordPress notification emails on or
off (over 25 triggers across 8 categories).
[⌊Network Dashboard — Aggregated delivery stats, top failing sites, and per-site
totals across the whole multisite network.⌉⌊Network Dashboard — Aggregated delivery
stats, top failing sites, and per-site totals across the whole multisite network
.⌉[
Network Dashboard — Aggregated delivery stats, top failing sites, and per-site totals
across the whole multisite network.
[⌊Network Sites — Per-site summary table showing the active mailer, override count,
and recent sent/failed counts, with a one-click editor for each site's overrides.⌉⌊
Network Sites — Per-site summary table showing the active mailer, override count,
and recent sent/failed counts, with a one-click editor for each site's overrides
.⌉[
Network Sites — Per-site summary table showing the active mailer, override count,
and recent sent/failed counts, with a one-click editor for each site’s overrides.
## Installation
1. Upload the `nimblymail-smtp` folder to `/wp-content/plugins/`.
2. Activate the plugin through the ‚Plugins‘ menu in WordPress.
3. Follow the setup wizard to configure your email provider, or go to NimblyMail >
Settings to configure manually.
## FAQ
### How do I configure SMTP?
Go to NimblyMail > Settings > Connection, select «Other SMTP» as your mailer, then
enter your SMTP host, port, encryption type, and credentials. Click «Save Changes»
and use the Email Tester under NimblyMail > Tools to verify delivery.
### Can I use Gmail to send emails?
Yes. Create an OAuth 2.0 Client ID (Web application) in your own Google Cloud project,
add the Authorized Redirect URI shown in NimblyMail > Settings > Connection to it,
then paste the Client ID and Client Secret into NimblyMail, select «Gmail / Google
Workspace» as your mailer, and click «Connect to Google» to authorize. NimblyMail
handles token refresh automatically. A hosted one-click connection through a NimblyMail-
operated OAuth service is not currently offered.
### Can I use Outlook or Microsoft 365 to send emails?
Yes. Register an application in your own Microsoft Entra (Azure) tenant, add the
Redirect URI shown in NimblyMail > Settings > Connection as a Web platform redirect
URI, then paste the Application (client) ID and client secret into NimblyMail, select«
Outlook / Microsoft 365» as your mailer, and click «Connect to Microsoft» to authorize.
Mail is delivered through `smtp.office365.com:587` using XOAUTH2. A hosted one-click
connection through a NimblyMail-operated OAuth service is not currently offered.
### How does the Developer Sandbox work?
Turn it on under NimblyMail > Settings > Sandbox. Choose Log Only to capture every
email locally without sending, or Redirect to rewrite every recipient to a single
safe address. You can also configure an allowlist (exact email or `*@domain.com`)
for addresses that should still be delivered for testing. The sandbox status is
visible on the WordPress admin bar so you never forget it’s on.
### How do I secure my credentials?
NimblyMail encrypts all stored credentials (passwords, API keys) using AES-256-CBC.
For additional security, you can define credentials as PHP constants in wp-config.
php instead of storing them in the database. For example: `define( 'NIMBLYMAIL_SMTP_PASS','
your-password' );`
### What happens to my email logs when I uninstall?
By default, all data is preserved when you deactivate. To remove all data on uninstall,
enable «Remove Data on Uninstall» under NimblyMail > Settings > Misc before deactivating.
### Can I import settings from another SMTP plugin?
Yes. NimblyMail can import settings from several existing SMTP plugins. The setup
wizard detects supported plugins automatically, or you can import manually from
NimblyMail > Tools > Import.
### How do I set up failure alerts?
Go to NimblyMail > Settings > Alerts, enable «Enable Alerts», and enter one or more
recipient email addresses. You can also add CC and BCC recipients. Alerts are sent
whenever an email fails to deliver.
### Does NimblyMail track usage data?
Only if you opt in — it’s off by default. When enabled, NimblyMail periodically
sends anonymous, aggregated data about your configuration and email volume (never
email content, recipients, or credentials) to help prioritize development. Turn
it off any time under NimblyMail > Settings, or permanently with the `NIMBLYMAIL_TELEMETRY_DISABLED`
constant in wp-config.php. See the External services section below for full details.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“NimblyMail SMTP – SMTP, Gmail, Outlook & Amazon SES Email Log and Deliverability
Plugin” is open source software. The following people have contributed to this plugin.
Contributors
* [ NimblyMail ](https://profiles.wordpress.org/nimblymail/)
[Translate “NimblyMail SMTP – SMTP, Gmail, Outlook & Amazon SES Email Log and Deliverability Plugin” into your language.](https://translate.wordpress.org/projects/wp-plugins/nimblymail-smtp)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/nimblymail-smtp/),
check out the [SVN repository](https://plugins.svn.wordpress.org/nimblymail-smtp/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/nimblymail-smtp/)
by [RSS](https://plugins.trac.wordpress.org/log/nimblymail-smtp/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.1.0
* Added: opt-in usage tracking — sends a small weekly report and a few lifecycle
events to help improve the plugin, entirely off by default. Every field sent
is documented in this readme; nothing identifying (email content, recipients,
passwords, API keys, site URLs, IP addresses) is ever included. Consent is asked
in the setup wizard, a dismissible notice for existing installs, and can be changed
any time under Settings, with a live preview of exactly what would be sent
* Added: a fifth Deliverability Health Audit pillar checking whether your sending
IP is listed on a DNS blocklist (DNSBL)
* Added: a generic outbound webhook channel for failure alerts, so a failed send
can notify Slack, Discord, or any endpoint you configure, independent of whether
the native email alert itself succeeds
* Added: each logged email now records which plugin or theme triggered it, with
a filter to narrow the Email Log by source
* Improved: the wordpress.org listing title, tags and description to better reflect
what the plugin does
* Fixed: a webhook alert URL could be pointed at an internal address; it is now
validated and rejected at save time and again immediately before sending
* Fixed: the DNSBL pillar could misread a blocklist provider’s rate-limit response
as an actual listing
* Fixed: on a Multisite network, a site that activated the plugin individually (
not network-wide) could incorrectly inherit another site’s usage-tracking consent
and identity
#### 1.0.9
* Fixed: Gmail and Outlook mail silently going out through the server’s PHP mail()
function when the account connection had expired or been revoked; the send now
fails visibly with a reconnect message, and a related reconnect error no longer
crashes the site
* Fixed: queued email silently losing an attachment when it could not be staged;
it now falls back to an immediate send with the attachment, and attachments outside
the allowed directories stay refused but are now noted in the email log
* Fixed: log retention and the dashboard 24-hour and 7-day windows being shifted
by the database server’s time zone offset
* Fixed: the Network Dashboard, Network Sites and settings import screens showing
an empty or all-clear state when their data failed to load; they now show an
error with a Retry button, and the Sites list no longer lets a slow earlier response
overwrite a newer page
* Improved: the readme now describes the bring-your-own-app Gmail and Outlook OAuth
setup and lists the Google and Microsoft endpoints, and the SendLayer endpoint
is corrected
#### 1.0.8
* Fixed: a DNS resolver failure being reported as a genuine SPF/DMARC failure instead
of «unavailable,» which could trigger a false failure alert
* Fixed: the deliverability audit scheduler running Action Scheduler queries on
every front-end page view instead of only when needed
* Fixed: the deliverability audit status showing a misleading «All checks passing»
when SPF/DKIM/DMARC were skipped entirely (no domain configured, or a public
mailbox domain)
* Fixed: the SPF check treating any syntactically-present record as valid, letting
+all (authorize anyone), a record with no real mechanism, or a lookalike include
domain all pass
* Fixed: the deliverability audit querying a different domain than mail is actually
sent from on www.-prefixed or multisite subdomain sites
* Fixed: the DMARC check failing a subdomain that has no DMARC record of its own
but correctly inherits one from its parent domain
* Fixed: the cached deliverability snapshot not being cleared when the active mailer
or sender email changed, including on a site’s very first settings save
* Fixed: the manual audit recheck throttle being engaged after the audit ran instead
of before, so a crashing audit could be re-triggered repeatedly with no cooldown
* Improved: the deliverability audit now has an overall time budget, so a slow
or unresponsive DNS resolver can no longer make it run indefinitely
#### 1.0.7
* Fixed: a masked password field rendering as editable mask text, risking accidental
credential corruption if edited without selecting all first
* Fixed: search/filter requests in Email Logs and Queue having no sequencing, letting
a slower earlier response overwrite newer results
* Fixed: failed Email Logs, Queue, and Settings data loads showing a misleading«
no data» state instead of an error
* Fixed: several destructive actions (cancel all queue items, delete/resend a log,
cancel a queue item) failing silently with no error toast on failure
* Fixed: the network test-email rate limit being scoped per-site instead of network-
wide, letting it be exceeded proportionally to network size
* Fixed: FailureAlert caching stale settings across switch_to_blog() calls, which
could suppress or misroute a failure alert during network operations
* Fixed: the Setup Wizard link on the Network Settings screen writing to the wrong(
site-scoped) settings
* Improved: added the ability for a super admin to reset a sub-site’s settings
overrides directly from Network Admin
#### 1.0.6
* Fixed: a provider outage during a batch send (e.g. a WooCommerce order run) being
able to trigger one failure-alert email per recipient instead of a small bounded
number
* Fixed: settings imported from WP Mail SMTP and Easy WP SMTP storing debug-event
retention in the wrong unit, effectively disabling debug-log cleanup
* Fixed: importing a source plugin with no mailer configured silently switching
a working NimblyMail setup to PHP mail()
* Fixed: the setup wizard’s OAuth Connect step failing to save entered credentials
before starting authorization, which could also discard wizard progress
* Fixed: dashboard extension widgets never loading their data when they appear
after the dashboard’s initial page load
* Fixed: network activation being able to time out and lose network-wide default
settings on large multisite networks
* Improved: Outlook / Microsoft 365 settings import support — Outlook credentials
can now be imported from WP Mail SMTP, Easy WP SMTP, and Fluent SMTP
* Improved: network activation on large multisite networks now provisions sites
in the background instead of one request
#### 1.0.5
* Security: Fixed the delivery-error admin notice exposing another user’s email
address and raw transport error to any logged-in user, not just administrators
* Security: Fixed the settings-import preview returning credentials in cleartext
* Security: Fixed a sub-site admin being able to read the main site’s stored credentials
via settings import on a multisite network
* Security: Fixed a network-wide settings save being able to leave every site’s
Developer Sandbox in an unsafe, incoherent state
* Security: Fixed network REST requests being able to stay pinned to the wrong
site’s data for the rest of a request if an error occurred mid-operation
* Fixed: 8 Email Controls toggles that pointed at the wrong WordPress hook and
silently did nothing when disabled — some also produced PHP warnings and a false
delivery-failure alert
* Fixed: Email Log and Network Dashboard timestamps being shifted by the server’s
UTC offset
* Fixed: the setup wizard letting an abandoned earlier edit override freshly-imported
settings when backtracking to the Welcome step
* Improved: Network Dashboard stats aggregation so per-chunk work no longer grows
with network size, preventing a possible stall on very large networks
* Improved: the Network Sites list to reflect a site’s edited settings immediately
instead of waiting up to 5 minutes
* Changed: documented the extension contract for Ant Design Vue components used
by externally-registered Pro add-on components
#### 1.0.4
* Security: Fixed the deliverability audit’s connectivity check being usable to
probe internal network addresses, including cloud metadata endpoints, from an
admin account
* Security: Fixed OAuth access tokens leaking into debug logs for some accounts
* Fixed: the Developer Sandbox delivering mail live instead of failing safe when
misconfigured, and its allowlist not protecting Cc/Bcc recipients
* Fixed: Fluent SMTP import storing encrypted credentials as unusable ciphertext,
and importing an unsupported mailer silently falling back to PHP mail with no
warning
* Fixed: the setup wizard discarding typed settings when choosing the Default PHP
Mail option
* Fixed: 5 Email Controls toggles pointing at WordPress hooks that don’t exist
* Fixed: network activation crashing with a fatal error
* Changed: Email Logs now default to a 90-day retention floor until you touch either
cleanup method under Log Retention settings, so a site nobody has configured
can no longer grow the log table without bound. Toggling a cleanup method and
saving disables the default floor and respects your explicit choice from then
on, until that section is reset to defaults. On upgrade, sites that already saved
a cleanup preference keep it untouched; sites that never did will have log entries
older than 90 days removed by the next scheduled cleanup, so save a preference
first if you need to keep a longer history.
* Improved: Network Sites list and Network Dashboard performance on sites with
many subsites
* Improved: reduced the admin JavaScript bundle size by loading Ant Design components
on demand
#### 1.0.3
* Fixed: the post-activation conflict notice no longer expires unseen if you spend
more than 5 minutes in the setup wizard
* Fixed: queued emails that were interrupted by a server crash are now automatically
resent instead of getting stuck
* Fixed: retrying a queued email that is already sending can no longer cause a
duplicate send
* Fixed: a third-party plugin hook that throws an error after a successful send
can no longer cause a duplicate send
* Fixed: a rare race during upgrade that could permanently disable the faster log
search is now closed
* Improved: Email Logs search now uses the database’s full-text index instead of
scanning every stored email body
* Improved: admin pages preload their shared JavaScript libraries, reducing load
time
* Security: hardened settings validation, closed an OAuth token-refresh race condition,
and the Gmail/Outlook Client ID is now masked in the settings API like other
credentials
#### 1.0.2
* Fixed: the setup wizard now opens reliably after activation, and the mail-conflict
notice is no longer lost when the wizard redirect runs
* Fixed: PHP deprecation warning when opening the setup wizard on PHP 8.1+
* Fixed: log rotation no longer causes a fatal error when Action Scheduler is unavailable
* Fixed: Resend and SendLayer transports no longer send blank recipients to the
provider API
* Fixed: uninstall now removes all plugin options, user meta, and scheduled actions
* Improved: admin pages load faster thanks to shared vendor libraries being split
into cacheable chunks
* Security: patched frontend dependency advisories and hardened the release process
so development dependencies can never ship
#### 1.0.1
* Maintenance release with compatibility tested up to WordPress 7.0.
#### 1.0.0
* Initial release.
* Nine email providers: PHP mail, SMTP, Gmail OAuth, Outlook / Microsoft 365 OAuth,
Amazon SES, Resend, SendLayer, Brevo, ZeptoMail.
* Comprehensive email logging with search, filters, and resend.
* Background queue with three-tier priority, exponential backoff retries, attachment
staging, and admin retry/cancel tools.
* Developer Sandbox with Log Only and Redirect modes plus an allowlist for bypass
addresses.
* Automated deliverability health audit covering SPF / DKIM / DMARC / PTR with
mailer-aware requirements.
* Email controls to toggle 25+ WordPress notification emails.
* Failure alerts with CC/BCC support.
* AES-256-CBC credential encryption with HMAC-SHA256 verification.
* Per-install signed-refresh OAuth proxy protocol — leaked refresh tokens cannot
be replayed against the proxy from arbitrary hosts.
* PHP constants support for wp-config.php overrides.
* Settings import from supported existing SMTP plugins.
* Guided setup wizard with auto-detection.
* Modern Vue 3 admin interface.
## Meta
* Version **1.1.0**
* Last updated **2 Wochen ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.0 or higher **
* Tested up to **7.1.3**
* PHP version ** 8.0 or higher **
* Language
* [English (US)](https://wordpress.org/plugins/nimblymail-smtp/)
* Tags
* [Amazon SES](https://de-ch.wordpress.org/plugins/tags/amazon-ses/)[deliverability](https://de-ch.wordpress.org/plugins/tags/deliverability/)
[email log](https://de-ch.wordpress.org/plugins/tags/email-log/)[gmail smtp](https://de-ch.wordpress.org/plugins/tags/gmail-smtp/)
[smtp](https://de-ch.wordpress.org/plugins/tags/smtp/)
* [Advanced View](https://de-ch.wordpress.org/plugins/nimblymail-smtp/advanced/)
## Ratings
Es wurden noch keine Rezensionen eingereicht.
[Your review](https://wordpress.org/support/plugin/nimblymail-smtp/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/nimblymail-smtp/reviews/)
## Contributors
* [ NimblyMail ](https://profiles.wordpress.org/nimblymail/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/nimblymail-smtp/)