Duva Mail

WordPress sends its emails with the web server’s mail function, which is often unreliable and ends up in spam. Duva Mail replaces that transport: every email sent with wp_mail() (WooCommerce orders, contact forms, password resets, comment notifications, any plugin) is submitted to your Duva account over HTTPS.

• Works with anything that calls wp_mail(): the plugin hooks the core pre_wp_mail filter, so WordPress keeps its usual contract (true on success, false and the wp_mail_failed action on failure).
• Respects the wp_mail_from, wp_mail_from_name and wp_mail_content_type filters, and reads From, Reply-To, Cc, Bcc and Content-Type headers (strings or arrays, Name <address> recipients).
• Attachments from local files (10 files and 5 MB in total, as accepted by the Duva API).
• No silent fallback: if Duva cannot take the email, wp_mail() returns false, wp_mail_failed fires, and the failure is shown in Settings > Duva Mail and as an admin notice. The email is never sent by another transport behind your back.
• Safe retries: each email carries an idempotency key, so a network timeout is retried without ever creating a duplicate. Quota and client errors are never retried.
• API key kept out of the browser: the settings field never displays it, and you can define it in wp-config.php instead (DUVA_MAIL_API_KEY).
• No telemetry, no tracking, no calls to any server other than the API address you configure.

What you need

A Duva account with a verified sending domain, and an API key created for that domain in the Duva dashboard.

Things to know before you install

• Emails are sent from your Duva domain only. If WordPress (or a plugin) sets a sender on another domain, Duva Mail sends from your default sender address and puts the original sender in Reply-To, so contact-form replies still reach the visitor.
• To, Cc and Bcc: they are sent as the To, Cc and Bcc fields of the Duva API, with their names. Each address receives its own copy, which shows all the To and Cc recipients; a Bcc address appears only on its own copy. An email with Bcc recipients but no To recipient is refused, because Duva needs a To address.
• Only text/plain and text/html emails are supported. If an email has only an HTML body, Duva adds a plain-text version generated from it. Raw multipart/* bodies are refused with an explicit error.
• PHPMailer is bypassed. Plugins that customize PHPMailer (the phpmailer_init action) or that add their own SMTP settings have no effect on emails sent through Duva.
• The API refuses some custom headers (for example Return-Path, Message-ID); the email then fails with a message that names the header. See the FAQ.

External services

This plugin sends your site’s emails to the Duva API, a third-party service, at the API address set in the settings (default https://api.duva.ca). It is the plugin’s only purpose and the only external connection it makes.

• What is sent, and when: for each email WordPress sends, the sender, the recipients, the subject, the body, any attachments and custom headers are sent to Duva so that it can deliver the email. The “Check the connection” and “Send a test email” buttons also contact the API. Each request carries your API key, the language of the site (to localize error messages) and a user agent with the plugin, WordPress and PHP versions.
• What is not sent: nothing else about your site, your users or your visitors, and nothing is sent when no email is sent.
• Duva terms of use: https://duva.ca/en/terms
• Duva privacy policy: https://duva.ca/en/privacy