SMTP submission

Use SMTP submission when an application supports SMTP but cannot call the SendMailOS HTTP API directly. It accepts outbound messages only; it does not create an inbox or receive replies.

Connection settings

The dashboard shows the password once. Store it in your application's secret store. Revoke it under API Keys → My Keys if it is exposed. Use a separate password for each application. If your application has a stable public IP, you may restrict the key to it: the SMTP relay signs the client IP so the API can enforce that restriction. Transport security is mandatory; plaintext authentication is rejected.

Immediately after creating a password, you can download a connection CSV with the host, username, password, domain, and both port options. The password is not retrievable later. Keep the CSV private or delete it after configuring your SMTP client. Creating another password does not reveal the previous one.

Existing connections configured with the old username apikey continue to work. Only the password identifies the credential; the username is shared by all SendMailOS SMTP clients.

This server also runs another Postfix service on standard ports 465/587, so SendMailOS currently uses 2465/2525. Apps that only support standard SMTP ports need a dedicated SendMailOS IP or host before they can connect.

For WordPress, choose Other SMTP in a mail plugin and enter the settings above. Use a From address on the domain selected when you created the SMTP password. Turn on the plugin's “force From address” option if other plugins override it. A transactional form notification may use From: forms@yourdomain and Reply-To: [email protected]; using the visitor address as From is rejected because it is not your verified sending domain.

SMTP acceptance means SendMailOS queued the message. It does not mean SES or the connected BYOS server delivered it. The domain's existing sending route determines whether the worker uses SES, the connected server, or an explicitly configured SES fallback. A server-only route waits when its server is offline. Review Email Logs and delivery events for the final result. The same verified-domain, suppression and quota checks used by POST /v1/emails apply. Test-mode credentials simulate sends.

Production SES sends use one hosted email credit per recipient. Sends that go through your connected server have their accept-time credit returned. When the hosted credit balance is exhausted, a domain configured for server only can still accept SMTP mail without a credit; that message waits for its server and cannot fall back to SES. Hybrid routes need a hosted credit because they may use SES if the server is unavailable.

Messages may contain plain text or HTML. SMTP attachments are currently rejected because the BYOS route cannot yet preserve them; use the HTTP API for attachments on SES-routed domains. The SMTP message size limit is 20 MiB. Unsupported MIME structures are rejected with a permanent SMTP error so content is never silently discarded. A 4xx SMTP reply means the client should retry; a 5xx reply needs a configuration or message change. Each message needs a unique Message-ID header, which WordPress mailers normally generate. SMTP retries use it to avoid duplicate queue entries after a lost acknowledgement while allowing a second, intentional notification with the same subject and body.