Fix Website SMTP Relay Errors for Instant Newsletter Delivery

If your site’s newsletter queue sits “pending,” contacts never get the welcome series, or every campaign bounces with “relay access denied,” you have an SMTP relay problem—not a vague “email issue.” This guide walks homeowners and small-business operators through the exact failures that block transactional and bulk mail, the commands and settings that clear them, and when it is smarter to hand the stack to a specialist.

Fixwebnode provides hands-on Website support for SMTP, WordPress mailers, and DNS authentication so newsletters leave the server the moment you hit send. Whether you host on a VPS, shared plan, or managed WordPress box in Geelong or further afield, the checks below are the same ones we run on production sites.

Why SMTP relay errors kill newsletter delivery

Modern inbox providers reject mail that cannot prove who sent it and that the sending host is allowed to relay. A single mis-set port, expired app password, or missing SPF include can mark your domain as untrusted. Campaign tools then throttle or drop the queue. Fixing relay is not optional polish—it is the difference between instant delivery and a silent black hole.

Below are four distinct failure modes we see repeatedly, each with symptoms you can recognise and numbered DIY steps you can run safely.

Common SMTP relay issues (unique symptoms)

1. Authentication rejected — “535 5.7.8” or “relay not permitted”

The SMTP user or app password is wrong, the plugin still uses the old mailbox password after a forced reset, or the host requires OAuth/app passwords while you are sending plain credentials. Mail never leaves the MTA.

2. SPF / DKIM / DMARC gaps — soft-fail then hard bounce

Newsletters leave your server but Gmail, Microsoft 365, and Yahoo return “550 5.7.26 Unauthenticated email” or land in spam. DNS either lacks an SPF include for your relay host or DKIM selectors do not match the signing key.

3. Port, TLS, or ISP block — connection timeout on 25/465/587

Outbound port 25 is firewalled by the VPS provider or residential ISP; the plugin is set to SSL on 465 while the host only offers STARTTLS on 587; or certificate name mismatch aborts the handshake.

4. WordPress / plugin relay mis-wire — PHP mail() fallback

WP Mail SMTP, FluentSMTP, or a custom theme still falls back to PHP mail(), so messages appear “sent” in the log but never hit a real SMTP relay. Contact forms and newsletter plugins share the same broken path.

How to fix each issue step by step

Fix 1 — Restore valid SMTP authentication

Confirm the mailbox still exists, generate a fresh app password if the provider enforces 2FA, and force the site to use explicit SMTP instead of sendmail.

Step 1 — Test credentials from the server shell

sudo apt-get update && sudo apt-get install -y swaks
swaks --to you@example.com \
 --from newsletter@yourdomain.com \
 --server smtp.yourprovider.com \
 --port 587 \
 --auth LOGIN \
 --auth-user newsletter@yourdomain.com \
 --auth-password 'YOUR_APP_PASSWORD' \
 --tls \
 --quit-after DATA

A clean 250 OK means the account and port work. Any 535 means rotate the password in the provider panel and update the site.

Step 2 — Lock WordPress (or your CMS) to those credentials

In WP Mail SMTP / FluentSMTP set: host = provider SMTP hostname, port = 587, encryption = TLS, authentication = on, user/pass = the values that passed swaks. Disable “Return-Path override” unless your host documents it.

Step 3 — Send a real test and read the transcript

# From wp-cli if available
wp eval 'wp_mail("you@example.com", "SMTP probe", "body");'

Check the plugin mail log for the full SMTP dialogue. If auth still fails, the plugin cache may hold the old secret—clear object cache and re-save.

When to call Fixwebnode: provider requires OAuth2 (Google Workspace, Microsoft 365) or you manage multiple brands and cannot risk locking the mailbox. We wire the OAuth flow and verify relay under load.

Fix 2 — Align SPF, DKIM, and DMARC with the relay

Authentication failures after a successful SMTP session almost always live in DNS.

Step 1 — Inventory current records

dig +short TXT yourdomain.com
dig +short TXT default._domainkey.yourdomain.com
dig +short TXT _dmarc.yourdomain.com

Step 2 — Publish a strict-enough SPF that includes only your real relays

v=spf1 include:_spf.google.com include:mail.protection.outlook.com include:spf.yourhost.com -all

Replace includes with the hosts you actually use. Do not stack more than ~10 DNS lookups. Use -all only after soft-fail testing.

Step 3 — Enable DKIM at the ESP or mail host and paste the selector TXT

Generate the key in your SMTP provider panel, publish selector._domainkey.yourdomain.com, then force a signed test:

swaks --to check-auth@verifier.port25.com \
 --from newsletter@yourdomain.com \
 --server smtp.yourprovider.com \
 --port 587 --auth LOGIN \
 --auth-user newsletter@yourdomain.com \
 --auth-password 'YOUR_APP_PASSWORD' --tls

Read the Port25 (or mail-tester) report for DKIM pass.

Step 4 — Start DMARC in monitor mode

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1

Raise to p=quarantine once weekly reports show clean alignment.

When to call a pro: you inherited a domain with conflicting SPF strings, third-party CRMs adding their own includes, or BIMI requirements. Fixwebnode consolidates records without breaking existing transactional mail—the same discipline we apply on specialised builds such as Collingwood WordPress Contact Form & SMTP Fixes | Stop Spam.

Fix 3 — Open the right port and complete TLS

Step 1 — Prove which ports leave your host

nc -vz smtp.yourprovider.com 587
nc -vz smtp.yourprovider.com 465
nc -vz smtp.yourprovider.com 25

Timeouts on 25 are normal on many cloud networks—move traffic to 587 with STARTTLS.

Step 2 — Inspect the certificate the server presents

openssl s_client -connect smtp.yourprovider.com:587 -starttls smtp -servername smtp.yourprovider.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

Hostname must match what your plugin trusts. If the chain is incomplete, install the provider’s intermediate or switch to the hostname on the cert SAN list.

Step 3 — Match plugin encryption to the working port

• Port 587 → TLS / STARTTLS
• Port 465 → SSL (implicit)
• Never leave “none” on a public relay

Step 4 — If the VPS firewall is the blocker

sudo ufw allow out 587/tcp
sudo ufw allow out 465/tcp
sudo ufw status verbose

On cloud security groups, add egress rules the same way. Retest with swaks.

When to book Fixwebnode: corporate firewalls, SELinux/AppArmor denials, or reverse proxies terminating TLS incorrectly. We map the full path from PHP-FPM to the edge.

Fix 4 — Stop PHP mail() fallback and wire a real relay

Step 1 — Detect the active mailer

wp config get WP_MAIL_SMTP_HOST 2>/dev/null || true
grep -R "wp_mail\|PHPMailer" wp-content/plugins/wp-mail-smtp -n | head

Step 2 — Force SMTP constants (optional hard lock)

# wp-config.php fragments — use real values
define('WPMS_ON', true);
define('WPMS_SMTP_HOST', 'smtp.yourprovider.com');
define('WPMS_SMTP_PORT', 587);
define('WPMS_SSL', 'tls');
define('WPMS_SMTP_AUTH', true);
define('WPMS_SMTP_USER', 'newsletter@yourdomain.com');
define('WPMS_SMTP_PASS', 'YOUR_APP_PASSWORD');

Step 3 — Disable theme/plugin code that calls mail() directly

Search custom plugins for mail( and replace with wp_mail so the SMTP layer stays in control.

Step 4 — Verify end-to-end

wp mail test you@example.com --subject="Relay check"

Confirm the message headers show your DKIM signature and the correct Return-Path.

When DIY stops: multisite networks, custom membership plugins, or builders’ brochure sites that mix contact forms with drip campaigns. Teams that need industry-specific site work can also review Website Solutions for Canberra Builders & Construction Specialists for how we keep forms and mail reliable on operational sites.

When DIY is enough vs when to book Fixwebnode

DIY is enough when a single mailbox, one domain, and a standard WordPress SMTP plugin are involved—and swaks already authenticates cleanly. Spend an hour on the four fixes above, re-run a campaign to a seed list at Gmail/Outlook/Apple, and watch the logs.

Book a specialist when any of these appear:

• OAuth-only providers or rotating service principals
• Multiple sending domains, subaccounts, or agency client sites
• Intermittent 421/451 greylisting under newsletter volume
• Shared hosting that hides raw SMTP logs
• Prior spam listing (check blocklists) that needs delisting plus relay redesign

Fixwebnode works across All service areas with remote diagnostics first, then on-box changes only where required. Geelong-based operators get the same runbook as remote sites: credential proof, DNS alignment, port/TLS proof, then plugin lock-in—no marketplace bidding, just direct specialist work.

Get newsletters delivering again

SMTP relay errors are mechanical. Match auth, publish correct SPF/DKIM/DMARC, open the right TLS port, and stop silent PHP mail() fallbacks. Use the commands in this guide to prove each layer before you scale send volume.

If you want a second pair of eyes on the transcript, DNS, or WordPress mailer stack, start a conversation with Fixwebnode through our Website support page. Bring your latest bounce codes and we will map the shortest path back to instant newsletter delivery.