Transactional email for your storefront

Grade school

Your store needs a mail service to send emails, like a post office. The best choice is your own account. Then the keys belong to you.

If you want help, YPB can set things up for you for now at no extra cost.

High school

Your store sends email through a provider such as SendGrid or Brevo. We recommend opening that account yourself, in your business’s name, and keeping its login and keys.

If you’d rather not, YPB can help set up your branded email and DNS, and can send through credentials YPB manages. That courtesy has no separate charge today; we’ll tell you before that changes.

College

There are two ownership models. Customer-owned (the default): you hold the provider account, API key or OAuth grant, and pay any provider plan. YPB courtesy: YPB configures branded email and DNS with you and sends through credentials YPB manages.

Owning the account keeps your sending reputation, logs and billing under your control, and makes changing agencies simple. The courtesy model trades that control for convenience.

Postgraduate

The default allocates control, cost and accountability to the business that owns the brand: provider contract, credential lifecycle, suppression lists and sending reputation all sit with you. That limits single points of dependency on YPB and keeps an auditable separation between your data and ours.

The courtesy model is a service choice, not a technical requirement. Its current no-charge status is a policy, not a contract term, and YPB will give notice before any charge takes effect.

Developer

WooCommerce calls wp_mail(); the mailer plugin replaces PHPMailer’s transport with a provider API or SMTP. In the customer-owned model the credential (API key, OAuth refresh token or SMTP password) lives in your WordPress install and your provider account. Under courtesy sending, YPB installs and rotates the credential and it is never exposed to you or published.

Either way, DNS authentication is per domain and per provider, and the From domain must align with it.

Grade school

Your store should send email from an address with your store’s name in it, like support@brand.example. A Gmail or Yahoo address won’t work for this.

High school

Your store’s sender and reply addresses, and the address you use to contact YPB support, need to be on your own business domain — for example owner@brand.example. If you don’t have one yet, Google Workspace or Microsoft 365 can host a mailbox on your domain.

College

A branded address proves the mail comes from your business, and it’s the only kind a provider can authenticate for you: you can add SPF, DKIM and DMARC records to your own domain, but not to gmail.com. Mailbox services such as Google Workspace or Microsoft 365 connect to your domain through MX and verification records.

Shoppers can use any address to receive their order email. This rule only covers your business identities.

Postgraduate

Requiring a domain-controlled identity creates accountability. The domain owner can prove control, rotate who has access and publish authentication policy, whereas free consumer mailboxes are owned by individuals and cannot carry your DMARC policy. For support, it lets YPB relate a request to an organization, though a branded address alone never grants access to your store’s data: identity and organization membership are verified separately.

Developer

Free consumer domains (for example gmail.com, googlemail.com, outlook.com, hotmail.com, live.com, yahoo.com) aren’t eligible as sender, Reply-To or support-contact identities under YPB policy. Planned server-side intake checks will enforce this after normalizing case, whitespace and trailing dots. Workspace or Microsoft 365 tenants on a custom domain are welcome. DMARC alignment requires the RFC5322.From domain to match the DKIM d= or SPF-authenticated domain, which you can only publish on a domain you control.

Grade school

When someone orders, your store writes an email and hands it to a mail helper. The helper passes it to your email provider, which delivers it.

High school

WooCommerce doesn’t send email by itself. It hands each message to WordPress, and a mail plugin — WP Mail SMTP — passes it to your chosen provider. Choosing a provider in that plugin is what connects your store.

College

WooCommerce builds each message and calls WordPress’s mail function. Without a mail plugin, WordPress uses the web server’s own mail, which often fails authentication. WP Mail SMTP routes messages to a provider over an API or SMTP. Which providers are available depends on the plugin and its licence, not on WooCommerce.

Postgraduate

The mailer plugin is a single transport abstraction for every WordPress message, so provider choice, credential handling and failure handling concentrate there. API mailers give better error reporting and avoid SMTP port blocking; SMTP is a portable alternative for providers without a dedicated mailer, never an automatic fallback. Choosing a provider does not bypass the need for domain authentication.

Developer

WC_Emails → wp_mail() → phpmailer_init. WP Mail SMTP intercepts the send: API mailers POST to the provider (for example POST /v3/mail/send for SendGrid) and return provider errors to its debug log; the Other SMTP mailer configures PHPMailer for authenticated submission. Other plugins that call wp_mail() use the same path; code that calls a provider API directly does not.

Grade school

There are many email providers. SendGrid and Brevo are good picks for stores. If you already pay for Google or Microsoft email on your own domain, you can use that too.

High school

SendGrid and Brevo are built for store email and work with the free WP Mail SMTP plugin. Google Workspace and Microsoft 365 can send as your own mailbox, but they have daily limits, and Microsoft 365 needs WP Mail SMTP Pro. Pick one and follow its setup guide below.

College

Transactional providers (SendGrid, Brevo, Mailgun, Postmark and others) are designed for application email and offer delivery logs and bounce handling. Mailbox providers (Google Workspace, Microsoft 365) are simpler if you already have them, but have per-user sending limits. Check each mailer’s WP Mail SMTP plan requirement in the table.

Postgraduate

Weigh sending volume, deliverability tooling, data residency, cost and existing contracts. A transactional provider isolates store email from staff mailboxes; a mailbox provider concentrates identity in one tenant. Plugin licensing is a real cost: Amazon SES, Microsoft 365 and Zoho need WP Mail SMTP Pro or higher.

Developer

The table below reflects WP Mail SMTP’s mailer guide and the free plugin’s 4.9.0 source, where the Pro-only mailers (Amazon SES, Outlook, Zoho) are disabled. Credential types differ: API keys, OAuth client and refresh tokens, or SMTP credentials. Hosts, ports and DNS are provider-specific; nothing here is interchangeable between providers.

Grade school

Your email key is like a house key. Type it into your store yourself. Never send it to anyone in a message — not even to YPB.

High school

Create the key in your provider account and paste it straight into WP Mail SMTP in your WordPress admin. Don’t email it, put it in a support request or send it in chat. If YPB is helping, we can guide you on a screen share while you type it, or you can add YPB to your provider account as a team member if your provider supports that.

College

Credentials should travel the shortest path: provider → your browser → your WordPress settings. Anything copied through tickets, email or chat persists in systems you don’t control. For delegated setup, prefer a provider feature that grants a named YPB user limited access, and remove it when the work is done. Give each key only the permission it needs, such as SendGrid’s Mail Send.

Postgraduate

Treat the sending credential as a bearer secret: least privilege, single purpose, named owner, rotation on staff change or suspected exposure, and revocation that you control. Delegation through provider team accounts preserves attribution and revocability, which a shared secret does not. If a key has been exposed anywhere, revoke it in the provider and issue a new one; don’t just change where it’s stored.

Developer

WP Mail SMTP stores keys in the wp_mail_smtp option unless defined as constants. For sites under your own deployment control, keep secrets out of the database and repo by defining them from the server environment, for example:

define( 'WPMS_ON', true );
define( 'WPMS_MAILER', 'sendgrid' );
define( 'WPMS_SENDGRID_API_KEY', getenv( 'SENDGRID_API_KEY' ) );

Never commit keys, log provider responses verbatim, or expose keys to browser code. OAuth mailers store a refresh token; revoking the app in Google or Microsoft invalidates it.

Grade school

Your domain has a list of notes that tells other computers which services can send mail for it. Your provider tells you which notes to add. Leave the old notes alone.

High school

Each provider gives you a few DNS records to add so it can send as your domain. Add exactly what it shows, keep the records you already have, and don’t create a second SPF record. Your mailbox (MX) records don’t change when you choose a sending provider.

College

Sending uses SPF (which servers may send), DKIM (a signature) and DMARC (your policy and alignment check). Providers publish these differently: SendGrid uses CNAMEs on subdomains, Brevo uses TXT records, and Google and Microsoft use an SPF include plus DKIM. Receiving mail uses MX, which belongs to your mailbox provider.

Postgraduate

Each additional sender enlarges the domain’s authorization surface. Keep one SPF record within its 10-lookup limit, prefer provider CNAME delegation where offered, and stage DMARC from monitoring to enforcement using aggregate reports. See the DNS guide for the full treatment.

Developer

SPF evaluation is capped at 10 DNS-querying terms (RFC 7208 §4.6.4) and a name must not publish multiple SPF records (§3.2). SendGrid’s automated security delegates SPF to its em[NNNN] return-path CNAME, so the apex SPF record is unchanged. Details and per-provider record shapes are in the DNS guide.

Grade school

Send a test email to yourself. Check that it arrived, that it shows your store’s name, and that replying goes to your team.

High school

Use WP Mail SMTP → Tools → Email Test to send to a mailbox you own. Check the sender name and address, then reply to confirm replies reach your team. Place a test order on your DEV site, not your live store, to check the order emails.

College

A “sent” message in WordPress only means the provider accepted it. Confirm delivery in the provider’s logs, open the message’s headers to see SPF, DKIM and DMARC pass, and check it renders on phone and desktop. Test order and account email on DEV or UAT, which don’t email real customers.

Postgraduate

Separate acceptance into evidence tiers: provider acceptance, delivery to a controlled inbox, authentication results with alignment, rendering, and reply routing. Each is independent; a green domain badge proves none of the others. Keep test recipients and volumes controlled so testing never reaches customers.

Developer

Inspect Authentication-Results for spf=pass, dkim=pass header.d=brand.example and dmarc=pass. Correlate the provider message ID (for example SendGrid’s X-Message-Id) with the provider’s activity log. Enable WP Mail SMTP’s debug events while testing and disable them afterwards.

Grade school

If you switch email providers, set up the new one first, test it, then switch. Keep the old one working until the new one is ready.

High school

Brevo, SendGrid and the other supported providers are all fine choices, so you only need to switch if you want to. To switch, authenticate your domain with the new provider, create its key, change the mailer in WP Mail SMTP, test, and only then remove the old provider’s records.

College

Run the new provider’s DNS alongside the old one’s so there’s no gap in authentication. Change the mailer during a quiet period, send tests, watch delivery for a few days, then remove the old provider’s DKIM and verification records and revoke its key. Don’t run both mailers for the same messages.

Postgraduate

Plan a switch as a controlled change: inventory everything that sends (plugins, forms, scheduled jobs), pre-authenticate the new provider, cut over, observe, then retire. Keep the previous configuration recorded so you can roll back deliberately. Suppression lists and unsubscribes don’t transfer automatically; export and honour them where your provider allows.

Developer

Both providers’ DKIM keys can coexist (distinct selectors). If both need SPF authorization on the same name, merge them into one SPF record and count lookups. Switch WPMS_MAILER or the settings mailer atomically, drain queued sends first, and remove the old API key only after no consumer uses it.