Loops SMTP Settings and Configuration (2026)
Loops ships a real SMTP relay, but it is template-bound, not a generic MTA
Loops exposes smtp.loops.so at port 587 with STARTTLS. Credentials are unusual: the username is the literal string loops on every account and the password is a Loops API key. The catch is structural: “every email sent using Loops’ SMTP service requires a transactional email to be set up in your Loops account.” The body you hand the relay is an API-like JSON payload carrying a transactionalId and a dataVariables object, not arbitrary MIME. Transactional traffic only; campaigns never travel over this relay.
That distinction decides whether this tab is useful to you at all. If you are wiring Supabase auth emails, a Laravel or Rails mailer, a Django notification or Nodemailer into a product where every message is already a named template, the relay fits. If you want a drop-in SMTP endpoint for a WordPress plugin, a scanner, a CRM export or anything composing its own subject and HTML at send time, Loops will not serve you. For those workloads, a conventional relay such as Postmark, Resend or Amazon SES accepts raw MIME and gets out of the way. Loops sits closer to Customer.io and Klaviyo: the template is the product, the transport a convenience wrapped around it.
Quick reference
| SMTP server | smtp.loops.so |
| Port (STARTTLS) | 587 RECOMMENDED |
| Port (implicit SSL/TLS) | Not published by Loops |
| Alternative port | Not published by Loops |
| Username | loops – the literal word, identical on every account |
| Password | A Loops API key, from Settings › API in the dashboard |
| Message body | JSON payload with transactionalId and dataVariables |
| Traffic allowed | Transactional only, campaigns excluded |
| Sending domain | Custom domain required; no shared Loops domain |
SMTP configuration
Loops transactional relay
Submission endpoint for messages that already exist as published transactional emails in your Loops account.
Setup steps
- Add and verify your sending domain first. Without a verified custom domain there is no address to send from.
- Create the transactional email in the Loops editor, define its data variables, publish it, and copy its transactionalId.
- Generate an API key at app.loops.so/settings. That string is your SMTP password; store it as a production secret.
- Point your mailer at smtp.loops.so on port 587 with STARTTLS enabled, username loops, password set to the API key.
- Send with the JSON payload as the body, referencing the transactionalId and supplying every variable the template expects. Confirm delivery in the Loops activity view before sending production traffic.
Loops publishes guides for Django, Laravel, Rails and Supabase.
Authentication
Domain authentication on Loops is more prescriptive than on most relays and is the part of setup most likely to stall. A custom sending domain is mandatory, there is no shared Loops domain to fall back on while DNS settles. Loops asks for three record types: TXT, CNAME and MX. Follow the Type column in the dashboard, not the heading above each record; the two do not always agree, and copying by heading is the classic way to paste a CNAME into a TXT field.
SPF and DKIM
Loops hosts SPF on a dedicated subdomain, envelope.yourdomain.com, rather than at the root, “to prevent collisions with existing SPF records at the root domain.” If you already run Google Workspace, Microsoft 365 or another relay publishing SPF at the apex, Loops never touches it, a real advantage, since the ten-lookup SPF limit is where multi-vendor setups break down. The exact TXT value is generated per account, so copy it from the dashboard.
An MX record is also required, in the form 10 <pasted record name> where 10 is the priority. Registrars split on this: some want the priority in a separate field, others the whole string in one box. Get it wrong and verification never turns green.
DKIM is the easiest part, because Loops removes you from it: “You do not generate or manage keys yourself.” Loops generates the key pair, publishes what you add, and signs from your first send, no key file to protect, no rotation to schedule. The selector, key length and record type are not published, so do not plan an external audit around them.
DMARC and alignment
DMARC goes at _dmarc.yourdomain.com. Loops recommends starting in monitoring mode, and publishes this exact record as the starting point:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Follow the recommended progression literally. Run p=none for a few weeks and read the aggregate reports arriving at your rua address; they are the only way to find the forgotten application still sending as your domain. Move to p=quarantine after 2 to 4 clean weeks, then to p=reject after 1 to 3 months with no legitimate mail caught. Jumping straight to reject is how teams kill their own invoice notifications.
Alignment defaults to relaxed on both axes (aspf=r, adkim=r), and that default is load-bearing: relaxed SPF alignment is what lets a Return-Path on envelope.yourdomain.com align with a From address on the root domain. Set aspf=s for strict alignment and the subdomain stops aligning, so your SPF pass stops counting for DMARC; DKIM would still carry you, but you would have removed a leg for no benefit. A DMARC record at the root is inherited by subdomains.
Once SPF, DKIM and DMARC all pass, BIMI becomes available, putting a verified logo beside your messages in supporting inboxes. Loops does not state whether a Verified Mark Certificate is required.
Loops verifies with a “Verify Records” button; success shows as “Records present” in green. On propagation Loops is explicit: “Records can take up to 72 hours to propagate across all servers, though it is rarely more than 24 hours, and often within a few hours.” On Cloudflare, CNAME records must be set to DNS Only – leave the orange proxy cloud on and the record resolves to Cloudflare and verification fails, with nothing in the error pointing at the cause. On Google Domains, record names are sometimes shown wrapped in quotation marks; that is normal rendering, not a broken record, so do not strip them by hand. Loops also runs a free DNS checker.
Rate limits and sending caps
This is the thinnest part of the Loops documentation: Loops publishes rate limits for its REST API and for the free plan, and nothing at all for the SMTP relay.
| Limit | Value | Scope and behaviour |
|---|---|---|
| API requests, standard | 10 per second | Per team, standard REST API |
| API requests, Content API | 60 per 60 seconds | Per team, separate budget |
| Free plan send rate | 10 emails per second | Published on the pricing page for the free tier |
| Free plan volume | 4000 sends | Rolling 30-day window, with 1000 subscribed contacts |
| Headers returned | x-ratelimit-limit, x-ratelimit-remaining | Read these to pace your own client |
| Over-limit behaviour | HTTP 429 | Rejected outright; no documented queue or buffer |
| SMTP relay throughput | Not published | No separate SMTP limit appears in the Loops documentation |
Read that row before sizing a batch job. Loops documents no SMTP throughput ceiling, no per-connection message cap and no concurrent connection limit. Assume the API figures describe the platform’s tolerance, pace SMTP submission at or below 10 messages per second, and add retry with backoff. There is no documented queue: over the limit returns 429 and the message is gone unless you retry.
Common setup gotchas
The username is the word “loops”, not your email address
Every other SMTP form wants your email address or account login in the username field. Loops wants the literal five-character string loops, identical for every customer. This is the most common authentication failure on the service, and the symptom is a generic auth rejection that says nothing about which field is wrong. Check the username before regenerating API keys.
No pre-existing transactionalId means no send, ever
The relay does not accept arbitrary MIME. Every message must reference a published transactional email that already exists in your account with the data variables it declares. So any tool that writes generic SMTP settings into a config screen, a WordPress plugin, a scanner, a NAS, a monitoring agent, a legacy application, authenticates and then fails to deliver anything useful, because it composes its own body. No setting relaxes this.
Transactional only, campaigns never touch SMTP
Loops states the scope plainly: SMTP carries transactional email, powering messages in platforms like Supabase and frameworks like Laravel, Rails, Django and Nodemailer. Campaigns, loops and sequences are composed and dispatched inside the Loops application. Driving newsletter volume through the relay from an external system is not a supported path; the alternative is the campaigns API.
Loops itself warns against making it your default mail backend
In its own Django guide, Loops advises a dedicated connection for individual emails rather than installing the relay as the framework’s default backend, “since the service requires sending data in an API-like payload format.” Take that at face value: wire it as the default and every unrelated message your framework sends, password resets from a third-party package, error reports, admin notifications, gets routed into a relay that cannot render it. Use a named connection for the messages that have Loops templates behind them.
Migrating SMTP setups
Moving to Loops
Budget for this as an integration project, not a configuration change. On a conventional relay, migration means swapping a hostname and a credential pair and watching the logs. On Loops, every distinct message must first exist as a published transactional email with its variables declared and its transactionalId recorded, and the calling code must then emit the JSON payload rather than render locally.
Sequence it carefully: verify the sending domain first, remembering the 72-hour outer bound; build the templates while you wait; then cut over message types one at a time, highest-volume last, keeping the old relay configured until each is confirmed arriving.
Moving away from Loops
Understand the asymmetry before you commit. Your templates live inside Loops. Leaving means reimplementing every one elsewhere, in your codebase, a template engine, or the destination provider’s system, and rewriting every call site back to ordinary message composition. Contacts and events export through the API; the design work does not.
If the destination is a plain relay like MailerSend, SMTP2GO or SocketLabs, the transport side is trivial and the work is all in reconstructing templates. Keep your sending domain’s DNS under your own control: SPF, DKIM and DMARC all need repointing, and a domain you cannot edit on cutover day turns a migration into an outage.
Frequently asked questions
What are the Loops SMTP server settings?
Host smtp.loops.so, port 587 with STARTTLS, username loops (the literal word, same for every account), password set to a Loops API key. Loops publishes no implicit SSL port and no alternative port.
Why does my SMTP authentication keep failing?
Almost always the username. Loops expects the literal string loops, not your email address or account login, and the password is an API key, not your account password.
Can I use Loops SMTP with a WordPress plugin or a scanner?
No. Loops requires the message body to be a JSON payload referencing a transactional email that already exists in your account. Tools that compose their own subject and HTML authenticate and then fail to send anything usable. Use a conventional relay for those senders.
Can I send marketing campaigns over Loops SMTP?
No. The relay carries transactional email only; campaigns, loops and sequences are sent from inside the Loops application or through the campaigns API.
Why does Loops put SPF on an envelope subdomain?
To prevent collisions with any SPF record already published at your root domain. Relaxed DMARC alignment, the default, is what lets that subdomain still align with a From address on the root domain.
How long does domain verification take?
Loops states records can take up to 72 hours to propagate, though it is rarely more than 24 hours and often a few hours. If verification stalls, check that Cloudflare CNAMEs are set to DNS Only and that the MX record kept its 10 priority value.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.
