Identify the transport before editing DNS
A WordPress event does not identify its outbound mail provider. Inventory password resets, contact forms, order notifications and any newsletters. For each, record the plugin or application generating it, its From address, and whether a configured SMTP or API integration replaces the default route. Save a received original and the current transport settings before making changes.
WP Engine recommends a third-party email host for stronger mail functionality and says it does not provide MX or DKIM values for email hosting. Its sending guide also documents limitations of the default service. Do not promise a universal WP Engine customer-domain DKIM selector. Sending email on WP Engine.
Choose the documented route-specific configuration
For the default WordPress relay, WP Engine's authentication guide identifies MailChannels and documents include:relay.mailchannels.net in SPF. Merge that mechanism only where it is appropriate for the actual envelope domain and current route. Preserve other required senders in the existing policy. A mechanism copied into the visible From domain's SPF does not establish alignment when the envelope uses a different domain. WP Engine mail records.
For an external SMTP or API service, obtain the current domain-verification, DKIM and envelope instructions from that service. Configure the WordPress integration using its supported transport. WP Engine documents that port 25 is unavailable and lists allowed alternatives; confirm the chosen service and encryption settings are supported. WP Engine sending guide.
Do not change inbound MX routing merely to send website notifications. Similarly, a website A-record change should not accidentally move a mail hostname that follows the website through an alias. Keep the inbound mailbox owner involved if a DNS migration is planned, but separate that migration from this outbound authentication task.
Use an identity the site is authorized to send
For contact forms, make the visible From a domain your organization controls and has authenticated with the actual sending service. Put the visitor's address in Reply-To when the application supports that arrangement. Treat this as an application-design recommendation, not a claim about a particular plugin's default behavior. A visitor's external domain is not yours to authenticate.
Obtain DKIM values from the real signer. Publishing a self-created key in DNS cannot make a relay sign with its matching private key. Likewise, adding a generic SPF include cannot repair absent or unaligned DKIM. Verify the complete SPF policy for the evaluated envelope domain, including the lookup budget, before deploying a merged record. SPF, DKIM.
Trigger the actual WordPress events
Use a controlled test account and non-customer destinations. Test the event, not just the SMTP plugin's connection button. Keep the timestamp, application event, configured transport, provider response and received original together.
- Event: Password reset; Important distinction: Application-generated route versus plugin test; Acceptance evidence: Received original and successful intended delivery
- Event: Contact form; Important distinction: Visitor Reply-To versus approved From; Acceptance evidence: Aligned authenticated From and correct reply target
- Event: Order notification; Important distinction: Transaction workflow versus manual test; Acceptance evidence: Harmless test event through the same transport
- Event: Scheduled job; Important distinction: Background execution versus interactive sending; Acceptance evidence: Message and provider trace for the scheduled path
This is a synthetic acceptance matrix, not executed WP Engine testing. On every original, inspect the envelope domain and each DKIM d= and s= pair against trusted receiver results. A passing authentication method must also align with the visible From to satisfy DMARC. A successful plugin connection does not prove that result. DMARC.
Recover the route, not the entire domain
If no message arrives, separate application generation, transport submission and receiver acceptance before editing DNS. If the wrong route is used, review plugin precedence or application configuration. If authentication fails, inspect the exact signer or envelope service rather than assuming the web host supplies every record.
Pause a failing workflow or restore its previous approved transport while preserving working flows. Avoid a fallback that silently sends customer mail unauthenticated. Retest each affected event after repair, and remove unused credentials and DNS permissions when an external service is retired through the authorized change process. Keep secrets out of diagnostic artifacts. No website, provider account, message event or DNS change was exercised for this documentary guide.
Confirm the provider boundary
The current sending guide lists 2525 as recommended and 587/465 as allowed alternatives, with Microsoft 365 limited to 587 in that guidance. Use the selected provider’s supported encryption and transport settings, not a guessed port change. WP Engine does not publish its exact default hourly limit and describes limited server-side mail diagnostics; do not promise a numeric sending capacity or logs that have not been obtained.
Work through a fictional diagnostic case
Fictional written case only: WPE-01 assumes an SMTP plugin test from site@museum.example passes with d=museum.example, but the contact form sends From visitor@outside.example through an unknown transport. The form envelope and signatures are unknown. The website owner must map the actual event transport and use an approved organizational From with a separate visitor Reply-To where supported. The plugin result cannot establish form authentication or authorize the visitor domain. No account, DNS, CRM, invoice, campaign or delivery was tested for this case.
Separate a passing message from enforcement readiness
RFC 9989 Section 7.4 requires valid DKIM for a domain publishing p=reject and cautions about indirect-mail interoperability. A single aligned SPF result does not by itself justify a reject-policy rollout. Review all legitimate routes and policy ownership separately from this provider setup.