NimblyMail SMTP – SMTP, Gmail, Outlook & Amazon SES Email Log and Deliverability Plugin

NimblyMail is a comprehensive SMTP and email logging plugin designed to fix WordPress email deliverability issues. By default, WordPress uses the unreliable PHP mail() function, which often causes emails to land in the spam folder or never deliver. NimblyMail solves this by reconfiguring WordPress to securely route your site's emails through a proper SMTP server or dedicated email provider. Whether you need to connect via a standard SMTP host, Gmail OAuth, Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, or ZeptoMail, NimblyMail ensures your emails reach the inbox. Plus, with comprehensive email logging, a background queue, a developer sandbox, and an automated deliverability audit, you get full delivery monitoring and one-click troubleshooting. At a glance

• Nine email providers — SMTP, Gmail OAuth, Outlook / Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, ZeptoMail, and PHP mail.
• Free Email Logging — Comprehensive log with search, status filters, and one-click resend of failed emails.
• Background Queue — Defer wp_mail() calls to a non-blocking queue powered by Action Scheduler, with three-tier priority, exponential backoff retries, and admin tools to retry or cancel pending mail.
• Developer Sandbox — Stop staging and local environments from sending real email. Choose Log Only (capture and short-circuit) or Redirect (rewrite every recipient to a single safe address). Optional allowlist for addresses that should bypass the sandbox.
• Deliverability Health Audit — Automated DNS-based audit of SPF, DKIM, DMARC, and PTR for the active sender domain, with scheduled checks and human-readable findings per pillar.
• Clean, Modern Dashboard — Delivery stats, connection health, queue health widget, deliverability summary, and recent activity at a glance.
• Selectively disable WordPress notification emails across 8 categories (over 25 individual triggers).
• Failure alerts delivered via PHP's native mail() so a broken transport can't silence them.
• AES-256-CBC credential encryption with optional PHP-constant overrides in wp-config.php.
• First-class WordPress Multisite support with network defaults, per-site overrides, and per-field locks.
• Guided setup wizard with auto-detection and one-click import from existing SMTP plugins.

Supported Email Providers

• Other SMTP — Connect to any SMTP server (Outlook, Office 365, Mailgun, SendGrid, Zoho, etc.)
• Gmail / Google Workspace — Authenticate via Google OAuth using your own Google Cloud OAuth client (Client ID and Client Secret).
• Outlook / Microsoft 365 — Authenticate via Microsoft OAuth using your own Azure app registration (Application ID and Client Secret) and send through smtp.office365.com.
• Amazon SES — Send via AWS Simple Email Service
• Resend — Modern email API for developers
• SendLayer — Transactional email delivery service
• Brevo — Transactional email API (formerly Sendinblue)
• ZeptoMail — Zoho's transactional email service with regional endpoints
• Default (PHP) — Fallback to the built-in PHP mail function

Email Logging Every outgoing email is logged with recipient, subject, status, headers, and optional body capture. Search and filter logs by status (sent, failed, pending), resend failed emails with one click, and view full message details in a modal preview. Background Queue Turn the queue on under NimblyMail > Settings > Mail Queue and every wp_mail() call returns immediately. Messages are persisted to a database queue, dispatched by Action Scheduler in priority order (high / normal / bulk), and retried with exponential backoff on transient failures. Attachments are staged on enqueue so request-scoped tmp files cannot break delayed delivery. The Queue admin screen lists pending and failed items with retry / cancel actions, and the dashboard surfaces a queue-health widget. Test emails and admin alerts continue to send synchronously by default so you always get immediate feedback. Developer Sandbox Working on a staging copy or local clone? Turn on the sandbox to guarantee no real customer ever receives an accidental email. Pick Log Only to capture and short-circuit every wp_mail() call so they show up in the Email Log without leaving the host, or Redirect to rewrite every recipient to a single safe address with the originals preserved in X-NimblyMail-Original-* headers and a configurable subject prefix. An allowlist (exact email or *@domain.com) lets through addresses you do want delivered for testing. Sandboxing is settings-driven, switchable from the Network Admin on multisite, and visible at a glance via an admin-bar badge. Deliverability Health Audit NimblyMail runs an automated DNS audit of the active sender domain on a schedule (and on demand) and surfaces the result on the Deliverability page and the dashboard. The audit covers four pillars — SPF, DKIM, DMARC, and PTR — and is mailer-aware: required SPF includes and DKIM selectors are sourced from whichever provider you have configured (Gmail, Outlook 365, SES, etc.), with skip explanations for cases where a check does not apply. Findings are human-readable: each pillar shows pass/warn/fail with a one-line reason and a link to the relevant provider documentation. Email Controls Selectively disable WordPress notification emails you don't need — comment notifications, password reset emails, new user registrations, automatic update notices, and more. Over 25 individual email types across 8 categories can be toggled on or off. Failure Alerts Receive instant alerts when emails fail to deliver. Configure alert recipients with optional CC and BCC addresses. Alerts are sent via PHP's native mail function to bypass the broken transport. Security Credentials (SMTP passwords, API keys) are encrypted at rest using AES-256-CBC with HMAC-SHA256 verification. Settings can be locked via PHP constants in wp-config.php, making sensitive fields read-only in the admin UI. Settings Import Migrating from another SMTP plugin? NimblyMail automatically detects existing SMTP-plugin configurations and offers one-click import through the setup wizard. WordPress Multisite First-class multisite support. Network-activate the plugin once and every sub-site inherits the network defaults until a site admin explicitly overrides a field. Super admins get a Network Admin → NimblyMail surface with an aggregated dashboard, a sites table, per-field locks, and a per-site override editor. Clean Dashboard Built with Vue 3 and Ant Design, the dashboard is fast, responsive, and designed to feel native to WordPress. A guided setup wizard helps you configure everything in minutes, while the main dashboard provides a clear overview of your email delivery health. Usage Tracking Off by default. If you opt in under NimblyMail > Settings, NimblyMail periodically sends anonymous, aggregated data about your configuration and email volume — never email content, recipients, or credentials — to help prioritize development. Turn it off any time in Settings, or permanently with the NIMBLYMAIL_TELEMETRY_DISABLED constant. See External services below for full details.

1.1.0

• Added: opt-in usage tracking — sends a small weekly report and a few lifecycle events to help improve the plugin, entirely off by default. Every field sent is documented in this readme; nothing identifying (email content, recipients, passwords, API keys, site URLs, IP addresses) is ever included. Consent is asked in the setup wizard, a dismissible notice for existing installs, and can be changed any time under Settings, with a live preview of exactly what would be sent
• Added: a fifth Deliverability Health Audit pillar checking whether your sending IP is listed on a DNS blocklist (DNSBL)
• Added: a generic outbound webhook channel for failure alerts, so a failed send can notify Slack, Discord, or any endpoint you configure, independent of whether the native email alert itself succeeds
• Added: each logged email now records which plugin or theme triggered it, with a filter to narrow the Email Log by source
• Improved: the wordpress.org listing title, tags and description to better reflect what the plugin does
• Fixed: a webhook alert URL could be pointed at an internal address; it is now validated and rejected at save time and again immediately before sending
• Fixed: the DNSBL pillar could misread a blocklist provider's rate-limit response as an actual listing
• Fixed: on a Multisite network, a site that activated the plugin individually (not network-wide) could incorrectly inherit another site's usage-tracking consent and identity

1.0.9

• Fixed: Gmail and Outlook mail silently going out through the server's PHP mail() function when the account connection had expired or been revoked; the send now fails visibly with a reconnect message, and a related reconnect error no longer crashes the site
• Fixed: queued email silently losing an attachment when it could not be staged; it now falls back to an immediate send with the attachment, and attachments outside the allowed directories stay refused but are now noted in the email log
• Fixed: log retention and the dashboard 24-hour and 7-day windows being shifted by the database server's time zone offset
• Fixed: the Network Dashboard, Network Sites and settings import screens showing an empty or all-clear state when their data failed to load; they now show an error with a Retry button, and the Sites list no longer lets a slow earlier response overwrite a newer page
• Improved: the readme now describes the bring-your-own-app Gmail and Outlook OAuth setup and lists the Google and Microsoft endpoints, and the SendLayer endpoint is corrected

1.0.8

• Fixed: a DNS resolver failure being reported as a genuine SPF/DMARC failure instead of "unavailable," which could trigger a false failure alert
• Fixed: the deliverability audit scheduler running Action Scheduler queries on every front-end page view instead of only when needed
• Fixed: the deliverability audit status showing a misleading "All checks passing" when SPF/DKIM/DMARC were skipped entirely (no domain configured, or a public mailbox domain)
• Fixed: the SPF check treating any syntactically-present record as valid, letting +all (authorize anyone), a record with no real mechanism, or a lookalike include domain all pass
• Fixed: the deliverability audit querying a different domain than mail is actually sent from on www.-prefixed or multisite subdomain sites
• Fixed: the DMARC check failing a subdomain that has no DMARC record of its own but correctly inherits one from its parent domain
• Fixed: the cached deliverability snapshot not being cleared when the active mailer or sender email changed, including on a site's very first settings save
• Fixed: the manual audit recheck throttle being engaged after the audit ran instead of before, so a crashing audit could be re-triggered repeatedly with no cooldown
• Improved: the deliverability audit now has an overall time budget, so a slow or unresponsive DNS resolver can no longer make it run indefinitely

1.0.7

• Fixed: a masked password field rendering as editable mask text, risking accidental credential corruption if edited without selecting all first
• Fixed: search/filter requests in Email Logs and Queue having no sequencing, letting a slower earlier response overwrite newer results
• Fixed: failed Email Logs, Queue, and Settings data loads showing a misleading "no data" state instead of an error
• Fixed: several destructive actions (cancel all queue items, delete/resend a log, cancel a queue item) failing silently with no error toast on failure
• Fixed: the network test-email rate limit being scoped per-site instead of network-wide, letting it be exceeded proportionally to network size
• Fixed: FailureAlert caching stale settings across switch_to_blog() calls, which could suppress or misroute a failure alert during network operations
• Fixed: the Setup Wizard link on the Network Settings screen writing to the wrong (site-scoped) settings
• Improved: added the ability for a super admin to reset a sub-site's settings overrides directly from Network Admin

1.0.6

• Fixed: a provider outage during a batch send (e.g. a WooCommerce order run) being able to trigger one failure-alert email per recipient instead of a small bounded number
• Fixed: settings imported from WP Mail SMTP and Easy WP SMTP storing debug-event retention in the wrong unit, effectively disabling debug-log cleanup
• Fixed: importing a source plugin with no mailer configured silently switching a working NimblyMail setup to PHP mail()
• Fixed: the setup wizard's OAuth Connect step failing to save entered credentials before starting authorization, which could also discard wizard progress
• Fixed: dashboard extension widgets never loading their data when they appear after the dashboard's initial page load
• Fixed: network activation being able to time out and lose network-wide default settings on large multisite networks
• Improved: Outlook / Microsoft 365 settings import support — Outlook credentials can now be imported from WP Mail SMTP, Easy WP SMTP, and Fluent SMTP
• Improved: network activation on large multisite networks now provisions sites in the background instead of one request

1.0.5

• Security: Fixed the delivery-error admin notice exposing another user's email address and raw transport error to any logged-in user, not just administrators
• Security: Fixed the settings-import preview returning credentials in cleartext
• Security: Fixed a sub-site admin being able to read the main site's stored credentials via settings import on a multisite network
• Security: Fixed a network-wide settings save being able to leave every site's Developer Sandbox in an unsafe, incoherent state
• Security: Fixed network REST requests being able to stay pinned to the wrong site's data for the rest of a request if an error occurred mid-operation
• Fixed: 8 Email Controls toggles that pointed at the wrong WordPress hook and silently did nothing when disabled — some also produced PHP warnings and a false delivery-failure alert
• Fixed: Email Log and Network Dashboard timestamps being shifted by the server's UTC offset
• Fixed: the setup wizard letting an abandoned earlier edit override freshly-imported settings when backtracking to the Welcome step
• Improved: Network Dashboard stats aggregation so per-chunk work no longer grows with network size, preventing a possible stall on very large networks
• Improved: the Network Sites list to reflect a site's edited settings immediately instead of waiting up to 5 minutes
• Changed: documented the extension contract for Ant Design Vue components used by externally-registered Pro add-on components

1.0.4

• Security: Fixed the deliverability audit's connectivity check being usable to probe internal network addresses, including cloud metadata endpoints, from an admin account
• Security: Fixed OAuth access tokens leaking into debug logs for some accounts
• Fixed: the Developer Sandbox delivering mail live instead of failing safe when misconfigured, and its allowlist not protecting Cc/Bcc recipients
• Fixed: Fluent SMTP import storing encrypted credentials as unusable ciphertext, and importing an unsupported mailer silently falling back to PHP mail with no warning
• Fixed: the setup wizard discarding typed settings when choosing the Default PHP Mail option
• Fixed: 5 Email Controls toggles pointing at WordPress hooks that don't exist
• Fixed: network activation crashing with a fatal error
• Changed: Email Logs now default to a 90-day retention floor until you touch either cleanup method under Log Retention settings, so a site nobody has configured can no longer grow the log table without bound. Toggling a cleanup method and saving disables the default floor and respects your explicit choice from then on, until that section is reset to defaults. On upgrade, sites that already saved a cleanup preference keep it untouched; sites that never did will have log entries older than 90 days removed by the next scheduled cleanup, so save a preference first if you need to keep a longer history.
• Improved: Network Sites list and Network Dashboard performance on sites with many subsites
• Improved: reduced the admin JavaScript bundle size by loading Ant Design components on demand

1.0.3

• Fixed: the post-activation conflict notice no longer expires unseen if you spend more than 5 minutes in the setup wizard
• Fixed: queued emails that were interrupted by a server crash are now automatically resent instead of getting stuck
• Fixed: retrying a queued email that is already sending can no longer cause a duplicate send
• Fixed: a third-party plugin hook that throws an error after a successful send can no longer cause a duplicate send
• Fixed: a rare race during upgrade that could permanently disable the faster log search is now closed
• Improved: Email Logs search now uses the database's full-text index instead of scanning every stored email body
• Improved: admin pages preload their shared JavaScript libraries, reducing load time
• Security: hardened settings validation, closed an OAuth token-refresh race condition, and the Gmail/Outlook Client ID is now masked in the settings API like other credentials

1.0.2

• Fixed: the setup wizard now opens reliably after activation, and the mail-conflict notice is no longer lost when the wizard redirect runs
• Fixed: PHP deprecation warning when opening the setup wizard on PHP 8.1+
• Fixed: log rotation no longer causes a fatal error when Action Scheduler is unavailable
• Fixed: Resend and SendLayer transports no longer send blank recipients to the provider API
• Fixed: uninstall now removes all plugin options, user meta, and scheduled actions
• Improved: admin pages load faster thanks to shared vendor libraries being split into cacheable chunks
• Security: patched frontend dependency advisories and hardened the release process so development dependencies can never ship

1.0.1

• Maintenance release with compatibility tested up to WordPress 7.0.

1.0.0

• Initial release.
• Nine email providers: PHP mail, SMTP, Gmail OAuth, Outlook / Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, ZeptoMail.
• Comprehensive email logging with search, filters, and resend.
• Background queue with three-tier priority, exponential backoff retries, attachment staging, and admin retry/cancel tools.
• Developer Sandbox with Log Only and Redirect modes plus an allowlist for bypass addresses.
• Automated deliverability health audit covering SPF / DKIM / DMARC / PTR with mailer-aware requirements.
• Email controls to toggle 25+ WordPress notification emails.
• Failure alerts with CC/BCC support.
• AES-256-CBC credential encryption with HMAC-SHA256 verification.
• Per-install signed-refresh OAuth proxy protocol — leaked refresh tokens cannot be replayed against the proxy from arbitrary hosts.
• PHP constants support for wp-config.php overrides.
• Settings import from supported existing SMTP plugins.
• Guided setup wizard with auto-detection.
• Modern Vue 3 admin interface.