SMTP
Send email through any SMTP server. Configure this first: nothing in Plugboard emails anybody until an email connector exists.
| Category | |
| Authentication | Username and password |
| Reaches | Your SMTP server |
| Needs an agent | Only if the server is internal and you are hosted |
| Demo mode | No |
Capabilities
Section titled “Capabilities”email.send
Which is required by:
- Repair tracking links and ready-for-collection notices.
- Ticket acknowledgements, replies and closures.
- Purchase receipts to parents.
- Monitor alerts and backup failure alerts.
- Parent portal sign-in links.
- Scheduled reports and the daily digest.
That list is why this is the first connector to configure. Without it, most of the product works and nothing reaches anyone outside the ICT office.
Configuring it
Section titled “Configuring it”Admin, Connectors, SMTP Email, Configure.
Settings
Section titled “Settings”| Field | Default | Value |
|---|---|---|
host |
The SMTP hostname | |
port |
587 |
587 for STARTTLS, 465 for implicit TLS, 25 for an internal relay |
secure |
false |
True for port 465, false for 587 and 25 |
from |
The default From address |
The secure flag catches people out. It means “connect with TLS immediately”,
which is what port 465 does. Port 587 starts unencrypted and upgrades with
STARTTLS, so secure should be false there even though the connection ends up
encrypted.
Credentials
Section titled “Credentials”| Field | Value |
|---|---|
user |
The SMTP username |
pass |
The SMTP password |
Save and test. The test opens a connection and authenticates.
Common providers
Section titled “Common providers”Microsoft 365
Section titled “Microsoft 365”| Field | Value |
|---|---|
host |
smtp.office365.com |
port |
587 |
secure |
false |
user |
A licensed mailbox |
pass |
Its password, or an app password |
Microsoft 365 requires SMTP AUTH to be enabled on the mailbox, and it is disabled by default on newer tenants. Enable it per mailbox in the Exchange admin centre, or the authentication will fail with a message that does not obviously say so.
A high volume email connector, or a shared mailbox with SMTP AUTH enabled, is the usual arrangement. Sending as a person’s mailbox works and is a bad idea: their password change becomes your outage.
Google Workspace
Section titled “Google Workspace”Use the Google Workspace connector instead. It authenticates with a service account rather than a password, which is both more secure and less likely to break.
If you must use SMTP:
| Field | Value |
|---|---|
host |
smtp.gmail.com |
port |
587 |
secure |
false |
user |
The full email address |
pass |
An app password, not the account password |
An internal relay
Section titled “An internal relay”Many schools run an internal SMTP relay that accepts unauthenticated mail from known hosts.
| Field | Value |
|---|---|
host |
The relay hostname |
port |
25 |
secure |
false |
Leave the credentials blank if the relay authenticates by IP. If the relay is internal and you are on managed hosting, you need a connector agent, or a relay reachable from the internet.
A transactional service
Section titled “A transactional service”SendGrid, Postmark, Mailgun, Amazon SES and similar all speak SMTP and all work. They are worth considering if your school’s mail flow is already congested, or if deliverability matters and you would rather not fight your own SPF record.
Deliverability
Section titled “Deliverability”The one thing worth getting right, because a ready-for-collection email in a spam folder is a device that goes uncollected.
SPF. Your domain’s SPF record must authorise whatever is sending. If you send through Microsoft 365 or Google Workspace, it already does.
DKIM. Sign your outbound mail. Both major providers do this for you once enabled.
DMARC. Have a record, even a permissive one. Its absence is increasingly treated as a signal in itself.
Use a From address in your own domain that a person would recognise, such as
[email protected]. A From address at a provider’s domain is more
likely to be filtered and less likely to be trusted.
Testing properly
Section titled “Testing properly”The connector test proves authentication. It does not prove delivery.
After configuring:
- Lodge a test repair against yourself.
- Confirm the tracking email arrives, and in the inbox rather than the spam folder.
- Click the tracking link and confirm it opens. A broken link here means
PUBLIC_URLis wrong, not that email is broken. - Mark it ready and confirm the second message arrives.
Troubleshooting
Section titled “Troubleshooting”| Symptom | Cause |
|---|---|
| Authentication failed | Wrong credentials, or SMTP AUTH is disabled on the mailbox. Very common on Microsoft 365 |
| Connection timeout | Port 25 or 587 blocked outbound. Many networks block 25 in particular |
| TLS errors | secure does not match the port. True for 465, false for 587 |
| Sends, never arrives | Check the spam folder, then check SPF and DKIM |
| Arrives with a broken link | PUBLIC_URL is wrong. That is a configuration problem, not an email one |
| Works for staff, not for parents | External recipients. Your relay may only accept internal delivery |
| Nothing sends at all | Confirm the connector is enabled, not just saved |
Alternatives
Section titled “Alternatives”Google Workspace for Gmail sending with a service account. Console email for development.