# Send through the SMTP relay

Connect WordPress, your shop software or any app that sends email over SMTP to Ha Tang with smtp.hatang.dev, port 5870 and an API key.

Many tools can send email but cannot call an API: WordPress and WooCommerce, accounting and POS software, a website contact form, a scanner. Point them at Ha Tang's SMTP relay and their email goes out from your verified domain, with the same delivery, tracking and logs as everything else you send. Each message appears under **Email → Emails** with its status.

## Before you start

- A **verified sending domain**. The relay only accepts a sender address on a domain verified in your business. See [Add and verify a sending domain](https://hatang.dev/help/email/add-domain).
- An **API key with the Send permission**. It is your SMTP password. Creating keys needs the **Developer** access in the business; see [API keys](https://hatang.dev/help/integrations/api-keys).

## Connection settings

| Setting | Value |
|---|---|
| SMTP server (host) | `smtp.hatang.dev` |
| Port | `5870` |
| Encryption | **STARTTLS** (some apps call it "TLS") |
| Username | `hatang` |
| Password | Your API key (it starts with `ht_`) |
| Authentication | On (`PLAIN` or `LOGIN`) |

The same host, port, username and **Encryption** (**STARTTLS**) are listed under **Email → Email settings → Connection details**, with a ready-to-copy block of settings. In code, STARTTLS means `secure: false` (`SMTP_SECURE=false`): the connection is still encrypted, it just starts in plain text.

> [!WARNING]
> Port 5870 starts in plain text and then upgrades with STARTTLS. Do not choose **SSL**, **implicit TLS** or a "secure" connection option: the app then waits for an encrypted greeting that never comes and times out. Ha Tang does not listen on ports 465 or 587; use 5870.

The relay refuses to log in until the connection is encrypted, so your API key never crosses the network in clear text.

## Create the key

1. Open **Email → API Keys** and click **Create key**.
2. Name it after the app that will use it, for example `WordPress shop`.
3. Under **What this key can do**, tick **Send** for Email and nothing else. A key that can only send cannot read your contacts or change your domains if it leaks.
4. Optionally limit **Sending domain** to the one domain this app sends from.
5. Click **Create key** and copy the key at once: it is never shown again.

Give each app its own key, so you can revoke one without touching the others.

## WordPress with WP Mail SMTP

1. Install the **WP Mail SMTP** plugin and open **WP Mail SMTP → Settings**.
2. Set **From Email** to an address on your verified domain, for example `don-hang@mochuong.vn`, and turn on **Force From Email**.
3. Under **Mailer**, choose **Other SMTP**.
4. Fill in:

   | Field | Value |
   |---|---|
   | SMTP Host | `smtp.hatang.dev` |
   | Encryption | **TLS** (this is STARTTLS in WP Mail SMTP) |
   | SMTP Port | `5870` |
   | Auto TLS | On |
   | Authentication | On |
   | SMTP Username | `hatang` |
   | SMTP Password | Your API key |

5. Save, then send a test from **WP Mail SMTP → Tools → Email Test**.

The test appears under **Email → Emails** a few seconds later. WooCommerce order emails then go through Ha Tang too.

## Other apps

Look for the "SMTP", "outgoing mail" or "mail server" settings and enter the values from the table above. Things to check:

- **Sender address**: always an address on your verified domain. Apps that send from `wordpress@yourhost` or `root@localhost` are refused until you change it.
- **Encryption**: STARTTLS or "TLS", never SSL.
- **To**: put at least one address in the **To** field. If a message only has Bcc recipients, Ha Tang moves the first one into **To**, where the others can see it.

Developers will find ready-made settings for Laravel, Django, Rails, Spring Boot, Nodemailer, PHPMailer and Postfix in the [SMTP guide of the developer hub](https://hatang.dev/docs/guides/email/smtp).

## Limits

| Limit | Value |
|---|---|
| Recipients per message | 50 |
| Message size | 40 MB |
| Failed logins | After 10 failed logins from one IP address, logins from it are refused for 15 minutes |
| Daily quota | Shared with everything else you send: each message counts as one email. See **Email settings** |

## When it does not work

| What the app reports | Cause | What to do |
|---|---|---|
| Connection timeout | Wrong port, or SSL/implicit TLS chosen | Use port `5870` with STARTTLS |
| `535` authentication failed | The password is not a valid API key, or the key was revoked | Paste the key again, or create a new one |
| `421` too many failed authentication attempts | 10 failed logins from your server's address | Fix the password, wait 15 minutes, then retry |
| `550` with "domain is not verified" | The sender address is not on a verified domain of this business | Verify the domain, or change the sender address |
| `550` with "does not have the email:send scope" | The key has no **Send** permission | Create a key with **Send** |
| `550` because sending is paused | Someone paused sending under **Email settings** | Click **Resume sending** when it is safe |
| `452` too many recipients | More than 50 recipients in one message | Split the message |
| `451` temporary failure | A temporary problem, for example the daily quota is used up | Retry later; mail servers retry by themselves |

Every message the relay accepts is listed under **Email → Emails** with the source **SMTP**. If a message is missing there, the app never reached Ha Tang: check its own logs for one of the replies above.