Emerge Mail – SMTP, Newsletters & Email Marketing

Emerge Mail connects your WordPress site to Emerge, an email platform that sends through the email accounts you already own. Your site’s email — password resets, WooCommerce receipts, form notifications — and newsletters to your own contacts go out through your Gmail, Microsoft 365, Amazon SES, SMTP, SendGrid, Mailgun or Brevo account. No shared sending servers, no per-contact pricing.

Emerge is a hosted service, so an Emerge account is required to send. It’s free for up to 300 emails a day; paid plans raise the limits. Until you connect, the plugin leaves WordPress’s email as it was.

Site email through your own accounts

• Every wp_mail() goes out through your senders, with the SPF, DKIM and DMARC alignment of a real mailbox.

• Bounces and spam complaints come back to WordPress from every sender, Gmail included — no webhooks to set up.

• Email is never lost. If Emerge can’t take an email, WordPress’s default mail delivers it.

• Site email isn’t tracked. Opens and clicks are tracked for campaigns only.

Newsletters & campaigns

Formerly the Emerge Campaigns plugin, now built in:

• Contacts from your WordPress audience — users, commenters, WooCommerce and Easy Digital Downloads customers, Contact Form 7, Gravity Forms, MailPoet and more — synced to Emerge.

• Block-editor email templates with merge tags, and Query Loop blocks for recent posts.

• Campaigns and recurring newsletters to your Emerge segments — schedule, pause and resume.

• Automations that email a segment when a post is published, or welcome each new user.

• Subscribe forms — a shortcode, block or widget, with double opt-in through Emerge.

Also included, with or without an account

• Quiet admin notifications — stop the WordPress self-notifications you don’t want; they’re recorded in the Activity Log instead.

• Activity Log of fallbacks, send errors, bounces and suppressed notifications.

• For developers — every bounce fires emerge_mail_bounce_received; set an X-Emerge-Mail-Ref header on a send and it comes back as client_ref.

x, or moving from Emerge Campaigns? See the FAQ below.

External services

Emerge Mail sends through Emerge (1 below). Nothing is contacted until you click Connect Emerge. 1).

By installing and using this plugin you agree to use of these services.

1. Emerge (app.emerge-email.com)

What it is and what it’s used for: Emerge, the email platform operated by the plugin author. Only used if you click Connect Emerge — your site’s email then sends through the senders in your Emerge account, counted against your Emerge plan.

What data is sent, when:

• When you click Connect Emerge, your browser opens https://app.emerge-email.com/connect/wordpress with your site’s URL and name, a return URL in your WordPress admin, a random state and a PKCE code challenge. You sign in to Emerge (or create an account) and approve the connection there.

• Your site then posts the one-time code, the PKCE verifier, your site’s URL and name, the WordPress admin email address and the plugin version to https://app.emerge-email.com/api/wp/v1/link and receives an access key, stored locally, encrypted, in wp_options.

• While connected, each email your site sends is posted to https://app.emerge-email.com/api/wp/v1/messages — recipients, subject, body, attachments, From name and your X-Emerge-Mail-Ref header if set — so Emerge can deliver it. Emerge keeps a record of each message (recipient, subject, status) as described in its privacy policy. Your site also reads your plan, usage and senders from https://app.emerge-email.com/api/wp/v1/account to show them on the Senders screen, and a sender’s send-test button posts your admin email address to https://app.emerge-email.com/api/wp/v1/senders/{id}/test.

• Every 10 minutes while connected, your site reads bounces, complaints and unsubscribes for its email and contacts from https://app.emerge-email.com/api/wp/v1/changes.

• If you turn on Newsletters & campaigns:

• Your contacts — email address, subscription status, first and last name, and tags for where they came from and the segments they’re in — are synced to https://app.emerge-email.com/api/wp/v1/contacts (a first full sync, then changes every 10 minutes). The Contacts screen reads them back from there, and audience pickers read your segments from https://app.emerge-email.com/api/wp/v1/segments.

• When a campaign or newsletter sends, its rendered email and the Emerge segment it’s addressed to are sent to https://app.emerge-email.com/api/wp/v1/campaigns; Emerge picks the recipients, delivers it and records opens, clicks, bounces and unsubscribes, and the plugin reads the campaign’s stats back from there.

• Automations are created and updated at https://app.emerge-email.com/api/wp/v1/automations with their name and email content. When a user registers, their email address and name are sent there to enroll them in a “new user registered” automation; when a post is published, a “new post published” automation’s rendered email is sent there as a run.

• If you send subscribe-form signups to an Emerge signup form, each signup’s email address is posted to https://app.emerge-email.com/api/wp/v1/forms/{id}/submit, and Settings reads your forms from https://app.emerge-email.com/api/wp/v1/forms.

• Emerge acts as your processor for this contact data, under its privacy policy.

• Disconnect (in the plugin or in your Emerge account) revokes the key; after that nothing is sent to Emerge.

Terms and privacy:

• Terms of Service: https://emerge-email.com/terms-of-service

• Privacy Policy: https://emerge-email.com/privacy-policy

2. Emerge OAuth service (app.emerge-email.com) — direct connections made before 2.0

0. It brokers the OAuth handshake between your WordPress site and Google or Microsoft, holding the OAuth client secrets that Google and Microsoft would otherwise require every site to register individually.

What data is sent, when:

• When you reconnect a Gmail or Microsoft mailbox, your browser is redirected to https://app.emerge-email.com/oauth/{provider}/authorize with a PKCE code challenge and a state token generated by your site. No personal data is sent.

• When the provider redirects back, your site posts the authorization code and PKCE verifier to https://app.emerge-email.com/oauth/{provider}/token to receive the access and refresh tokens. The tokens are returned directly to your site and stored locally, encrypted, in wp_options. The proxy does not persist them.

• When an access token nears expiry, your site posts the refresh token to https://app.emerge-email.com/oauth/{provider}/refresh to obtain a new access token. Again, nothing is persisted on the proxy.

• No email content, recipient lists, or message metadata is ever sent to the proxy.

Terms and privacy:

• Terms of Service: https://emerge-email.com/wp-mail/terms-of-service

• Privacy Policy: https://emerge-email.com/wp-mail/privacy-policy

3. Google APIs (Gmail) — direct connections made before 2.0

0. com ) from your WordPress site. com/oauth2/v2/userinfo ) to verify the access token is still valid.

What data is sent, when:

• On each wp_mail() call routed through a Gmail connection: the full outbound message (To/Cc/Bcc, subject, body, attachments, custom headers) is POSTed to https://gmail.googleapis.com/gmail/v1/users/me/messages/send as a base64-encoded RFC822 message. This is what’s required for the message to reach the recipient.

• On token validation: a Bearer token is sent to https://www.googleapis.com/oauth2/v2/userinfo. No message data is included.

Terms and privacy:

• Google Terms of Service: https://policies.google.com/terms

• Google Privacy Policy: https://policies.google.com/privacy

• Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

4. Microsoft Graph (Outlook / Microsoft 365) — direct connections made before 2.0

0. com ) from your WordPress site. Periodically the plugin also calls Graph’s /me endpoint to verify the access token is still valid.

What data is sent, when:

• On each wp_mail() call routed through a Microsoft connection: the full outbound message (To/Cc/Bcc, subject, body, attachments, custom headers) is POSTed to https://graph.microsoft.com/v1.0/me/sendMail as a JSON payload. This is what’s required for the message to reach the recipient.

• On token validation: a Bearer token is sent to https://graph.microsoft.com/v1.0/me. No message data is included.

Terms and privacy:

• Microsoft Services Agreement: https://www.microsoft.com/en/servicesagreement

• Microsoft Privacy Statement: https://privacy.microsoft.com/en-us/privacystatement

5. SendGrid (api.sendgrid.com) — direct connections made before 2.0

0. The plugin sends every wp_mail() message routed through that connection directly to the SendGrid Mail Send API. The connect-time validation also calls SendGrid’s /v3/user/profile to confirm the API key works.

What data is sent, when:

• On each wp_mail() call routed through a SendGrid connection: the outbound message (recipients, subject, body, attachments, custom headers) is POSTed to https://api.sendgrid.com/v3/mail/send as a JSON payload.

• On connect: an authenticated GET is sent to https://api.sendgrid.com/v3/user/profile to validate the API key. No message data is included.

Terms and privacy:

• SendGrid Terms: https://www.twilio.com/legal/tos

• SendGrid Privacy Statement: https://www.twilio.com/legal/privacy

6. Mailgun (api.mailgun.net or api.eu.mailgun.net) — direct connections made before 2.0

0. The plugin sends every wp_mail() message routed through that connection directly to the Mailgun Messages API on the region (US or EU) you select at connect time.

What data is sent, when:

• On each wp_mail() call routed through a Mailgun connection: the outbound message (recipients, subject, body, attachments, custom headers) is POSTed as multipart/form-data to https://api.mailgun.net/v3/{your-domain}/messages (or the EU equivalent).

• On connect: an authenticated GET is sent to /v3/domains/{your-domain} to validate the API key + domain pairing. No message data is included.

Terms and privacy:

• Mailgun Terms of Service: https://www.mailgun.com/legal/terms/

• Mailgun Privacy Policy: https://www.mailgun.com/legal/privacy-policy/

7. Amazon SES (email.{region}.amazonaws.com) — direct connections made before 2.0

0. The plugin sends every wp_mail() message routed through that connection directly to the SES v2 SendEmail API in the AWS region you select at connect time. Requests are signed with AWS Signature V4 using the IAM credentials you provided.

What data is sent, when:

• On each wp_mail() call routed through a SES connection: the outbound message (recipients, subject, body, custom headers) is POSTed to https://email.{region}.amazonaws.com/v2/email/outbound-emails as a JSON payload.

• On connect: a signed GET is sent to /v2/email/account in the same region to validate the credentials. No message data is included.

• If you enable bounce handling for SES: when Amazon SNS posts its one-time subscription confirmation to your site’s webhook endpoint, the plugin completes the handshake by sending a GET to the SubscribeURL that Amazon includes (validated to only ever request amazonaws.com hosts). No message data is included. Thereafter SNS posts bounce/complaint notifications to your endpoint; the plugin does not initiate those.

Terms and privacy:

• AWS Customer Agreement: https://aws.amazon.com/agreement/

• AWS Privacy Notice: https://aws.amazon.com/privacy/

8. Brevo (api.brevo.com) — direct connections made before 2.0

0. The plugin sends every wp_mail() message routed through that connection directly to the Brevo Transactional Email API.

What data is sent, when:

• On each wp_mail() call routed through a Brevo connection: the outbound message (recipients, subject, body, attachments, custom headers) is POSTed to https://api.brevo.com/v3/smtp/email as a JSON payload.

• On connect: an authenticated GET is sent to https://api.brevo.com/v3/account to validate the API key. No message data is included.

Terms and privacy:

• Brevo Terms of Use: https://www.brevo.com/legal/termsofuse/

• Brevo Privacy Policy: https://www.brevo.com/legal/privacypolicy/

9. Your own SMTP server (Generic SMTP) — direct connections made before 2.0

0. The plugin opens an SMTP connection to whatever host:port you specify, authenticates with the username and password you provide, and sends wp_mail() messages via SMTP. WordPress’s bundled PHPMailer library handles the SMTP protocol.

What data is sent, when:

• On each wp_mail() call routed through this connection: the outbound message (recipients, subject, body, attachments, custom headers) is transmitted over SMTP to your configured host.

• On connect: PHPMailer opens the SMTP connection, runs EHLO + STARTTLS (if enabled), and authenticates — no message is sent.

Terms and privacy: Determined by whichever SMTP server you choose to connect to. This plugin does not introduce any third-party SMTP relay; you control the destination.