Flodesk SMTP Settings and Configuration (2026)

Two different people search this term. The first wants Flodesk to carry order receipts and password resets from WordPress or an app, impossible, and the fix is pairing Flodesk with a real relay such as Postmark, Amazon SES or Resend. The second, far more common, has marketing mail landing in spam and was told to “configure SMTP” when the real job is Flodesk’s DNS domain authentication, entirely doable, and the bulk of this page. If a native relay is a hard requirement for your marketing platform too, compare MailerLite, Kit, Mailchimp and Constant Contact.

Quick reference

Why Flodesk has no SMTP relay

Flodesk is a design-first marketing ESP for creators and small businesses, sold on a subscription that includes unlimited sends with no per-email charge and no send-volume pricing; price scales with active subscriber count instead. An open relay is incompatible with that model, because it accepts unbounded volume from whatever authenticates against it, a customer paying $19/month at 1,000 subscribers could push millions of messages the price never accounted for.

The second reason is deliverability control. Flodesk’s audience is largely non-technical and sends from shared IP pools that Flodesk warms and polices itself. Handing those pools a credential that any plugin, cron job or half-configured contact form could use would put every tenant’s reputation in the hands of the least careful one. So the sending layer stays closed and the only thing you configure is DNS, the records that authorise Flodesk’s servers to send as your domain. Flodesk’s own capability page lists its integration surface as native integrations, a developer API, an MCP server, Zapier and Pabbly Connect. SMTP and transactional sending are absent, deliberately. The REST API is not a workaround either: it has no message resource at all.

What you actually need instead

If you need to send transactional email

Receipts, password resets, shipping notices and magic links cannot go through Flodesk under any configuration. Route them to a provider built for the job: Postmark for teams that want transactional and marketing streams separated by default, Amazon SES for lowest cost at volume if you own bounce handling, Resend or MailerSend in between. All give a real hostname, port and credential pair, what the tool you were configuring asked for.

If you are connecting a CMS or an app

WP Mail SMTP and its equivalents need an SMTP host or a supported API mailer. Flodesk is neither, and there is no first-party Flodesk WordPress plugin. Point WP Mail SMTP at your relay and keep Flodesk for marketing. To get WordPress contacts into Flodesk, the part that genuinely works, use Zapier or Pabbly Connect to watch WooCommerce orders or Elementor submissions and call POST /v1/subscribers, which upserts on email so you can fire it on every order without deduplicating.

If you are routing internal notifications

Server alerts, cron reports and form-to-inbox notifications are transactional traffic wearing a different hat, and belong on a relay. SMTP2GO and Mailgun suit this because they accept plain SMTP from anything that can speak it, including appliances that will never learn a REST API. Flodesk has no role in this path.

Sending domain authentication

This is the section most people actually arrive for. Flodesk refuses free-provider sender addresses outright, and unauthenticated custom domains underperform badly against the bulk-sender rules Gmail, Yahoo and Microsoft enforce. Setup is DNS-only: no credentials to store anywhere.

The sequence: My account › Email setup › + Add new sender, enter the custom-domain address and display name, confirm ownership from the verification email. Then My account › Domain setup, and either let Flodesk write the records automatically at supported hosts or copy them out for manual entry. Each account supports up to two sending addresses, so up to two authenticated custom domains.

SPF and DKIM setup

Flodesk is unusual here and it matters. Where nearly every ESP hands you a TXT string with an include: mechanism to fold into your existing record, Flodesk delivers SPF as a CNAME. DKIM is CNAME too-three records or a single one depending on account type. Every hostname and target is account-specific and visible only inside Domain setup, so the block below is the shape, not the values.

; Flodesk sending domain authentication, record SHAPE only.
; Copy actual Host and Value strings from My account › Domain setup.

; --- SPF (delivered as CNAME, NOT as a TXT include) ---
Type   Host                        Value
CNAME  <flodesk-spf-host>          <flodesk-spf-target>

; --- DKIM (one OR three CNAME records, per account type) ---
Type   Host                        Value
CNAME  <flodesk-dkim-host-1>       <flodesk-dkim-target-1>
CNAME  <flodesk-dkim-host-2>       <flodesk-dkim-target-2>
CNAME  <flodesk-dkim-host-3>       <flodesk-dkim-target-3>

; --- DMARC (TXT) --- add ONLY if none already exists ---
Type   Host                        Value
TXT    _dmarc                      <flodesk-dmarc-policy>

; TTL: leave at registrar default. Propagation is usually minutes;
; allow up to 48 hours before opening a ticket.

Two rules break more Flodesk setups than anything else. First: the SPF CNAME goes in as its own new DNS record, never combined with an existing TXT SPF record. Second: paste values character for character, a trailing dot, a stray space, or a registrar that silently appends your domain to an already-qualified host fails verification with no useful error. Flodesk publishes host-specific walkthroughs for GoDaddy, Namecheap, Squarespace, Wix and Shopify; follow them literally, because each panel handles trailing-dot conventions differently.

DMARC alignment

Flodesk supplies DMARC as a TXT record with an explicit caveat: add it only if you do not already have one. A domain may hold exactly one record at _dmarc, and publishing a second does not merge policies, it invalidates DMARC evaluation for the whole domain. If you already run DMARC for a relay, a helpdesk or Google Workspace, keep that record and skip Flodesk’s.

Alignment is carried by the CNAME records. Flodesk signs with DKIM on hostnames delegated under your own domain, so once the CNAMEs resolve you get DKIM alignment and a DMARC pass without loosening an existing p=reject policy. Verify rather than assume: keep an aggregate reporting address in your record, send a campaign to a seed address, and confirm Flodesk’s sources appear with DKIM pass in the next RUA report before tightening anything.

Sending limits

There is no emails-per-hour figure to report, because Flodesk does not meter sends. The limits that bite are on the API and on your plan subscriber ceiling.

Every response carries X-Fd-RateLimit-Limit and X-Fd-RateLimit-Remaining. Pace against those rather than the headline number, because the batch throttle is not reflected in it.

Common mistakes

Pairing Flodesk with an SMTP provider

The recommended setup

Run both on the same domain with clear ownership of each traffic class: Flodesk keeps campaigns, newsletters and automation sequences, the relay carries everything triggered by a single user action. That usually means Postmark, which enforces the separation for you, or Amazon SES if cost per thousand dominates. Use a distinct subdomain for transactional mail-mail.example.com for receipts, apex for Flodesk campaigns, so a marketing complaint spike never drags password resets down with it.

Add both providers’ records in one sitting and verify each independently before pointing production traffic at either. Flodesk’s go in as CNAMEs; your relay hands you a TXT SPF include plus its own DKIM selector. They do not conflict unless you consolidate them.

Keeping the two systems from conflicting

Three conflicts recur, all avoidable. First, DMARC duplication: only one record may exist at _dmarc, so whoever authenticates second skips their provider’s DMARC step and relies on the record already in place. Publish it once and treat it as domain-level infrastructure, not a per-provider setting.

Second, double-sending. If a Zap pushes every WooCommerce order into a Flodesk workflow that sends a “thanks for your order” email while your store also fires a receipt through the relay, the customer gets two messages for one purchase. Draw the line explicitly, the relay owns anything the customer would call a record of a transaction, Flodesk owns anything they would call marketing, then audit your workflow triggers against it.

Third, suppression drift. Unsubscribes in Flodesk are invisible to your relay and bounces at the relay are invisible to Flodesk; neither cleans the other’s list. If you send anything list-shaped from the relay, digests, re-engagement, anything with an unsubscribe link, wire a webhook both ways, or accept that you will eventually mail someone who opted out on the other side. Flodesk exposes 3 webhook events at /v1/webhooks for exactly this glue.

Frequently asked questions