In this article11 sections
WordPress emails go to spam because, by default, WordPress hands them to the web server to send, and the web server is not an authorised mail sender for your domain. The message arrives with no valid signature, often from an address like [email protected] that does not exist, and Gmail and Outlook treat it as suspicious. The fix is to send WordPress mail through a real mailbox using SMTP, make sure the From address is on your own domain, and check that SPF and DKIM pass. It takes about fifteen minutes and fixes contact forms, order emails and password resets in one go.
This guide is for any WordPress site, including WooCommerce stores. You need a working mailbox on your domain, its SMTP settings from your email provider, and administrator access to WordPress.
Step 1: See what is wrong before changing anything
Send yourself a message from the site, for example by requesting a password reset to a Gmail address. Open it (check the spam folder), choose Show original from the three-dot menu, and look at the three results near the top:
SPF: SOFTFAIL with IP 203.0.113.20
DKIM: (none)
DMARC: FAILThat is the typical picture for a default WordPress install: the server’s IP address is not in your SPF record, nothing signed the message, and so it fails DMARC. Keep this as your “before”.
Step 2: Create or choose a mailbox to send from
Use a real mailbox on your own domain, such as [email protected] or [email protected]. A dedicated one is better than your personal mailbox: its password lives in the website, and you can change it without disturbing anyone. From your email provider you need four things:
| Setting | Typical value |
|---|---|
| SMTP host | mail.example.com or the name your provider gives |
| Port and encryption | 587 with STARTTLS (TLS), or 465 with SSL |
| Username | The full email address |
| Password | The mailbox password, or an app password if the provider requires one |
Step 3: Make WordPress send through SMTP
Install an SMTP plugin. WP Mail SMTP and FluentSMTP are the two most widely used, and both are free for this purpose. In the plugin’s settings choose “Other SMTP” and enter the four values from step 2. Then set:
- From Email: the mailbox you are sending through, for example
[email protected]. - Force From Email: on. This stops other plugins from replacing the address with something that will fail.
- From Name: your business name.
Tip. Both plugins can read the password from wp-config.php instead of storing it in the database. Use that option. A database backup or export then does not carry your mailbox password with it.
Step 4: Fix the From address in forms
This is the mistake behind most “my contact form emails vanish” reports. Many forms are set up so the notification appears to come from the visitor: From is set to the address they typed. Your server is then sending mail that claims to be from [email protected], which Gmail’s own policy tells every receiver to reject.
In each form’s notification settings:
| Field | Wrong | Right |
|---|---|---|
| From | The visitor’s email | [email protected] |
| Reply-To | Empty | The visitor’s email |
| To | Your own inbox |
You still reply to the visitor with one click, because Reply-To carries their address, and the message itself is honestly from your domain.
For WooCommerce, check WooCommerce → Settings → Emails and set the “From” address at the bottom of that page to the same mailbox.
Step 5: Check SPF and DKIM for the mailbox’s provider
Sending through your email provider’s server means their SPF and DKIM now apply, so confirm both exist for your domain:
dig +short TXT example.com | grep spf
dig +short TXT _dmarc.example.comThe SPF record must include your email provider. DKIM is set up in the provider’s control panel, which gives you a record to add to DNS if it is not there already. If you have no DMARC record yet, our guide to rolling out DMARC explains how to add one safely.
Step 6: Test again
Use the plugin’s Send test email button to a Gmail address, then trigger a real one: a form submission and, on a store, a test order. Open each with Show original. You want:
SPF: PASS with IP 198.51.100.7
DKIM: 'PASS' with domain example.com
DMARC: 'PASS'All three passing, with your domain named on the DKIM line, is the result that keeps mail in the inbox. Then switch on the plugin’s email log for a week, so you can see that every message the site sends was accepted.
If the test email fails to send
| Error | Cause | Fix |
|---|---|---|
Could not connect to SMTP host |
Wrong host or port, or the web host blocks outgoing SMTP | Try port 465 with SSL instead of 587; ask the web host whether SMTP ports are open |
Authentication failed |
Wrong password, or the provider needs an app password | Log in to webmail with the same details to confirm them |
Sender address rejected |
From address differs from the mailbox you logged in as | Make them the same, and force the From address |
| Sends, but still lands in spam | DKIM missing or not aligned, or the content looks like spam | Check step 5, then read the next section |
Still in spam with everything passing?
- The content. A message that is one link and no text, or a subject in capitals, is scored badly whoever sends it.
- A new domain. Domains registered in the last few weeks have no reputation yet. It improves as real mail is opened and answered.
- Recipients marking it as spam. Notification emails nobody asked for get reported. Send only what people expect.
- Newsletters through WordPress. Do not send bulk mail from the site’s mailbox. Use a newsletter service, and keep the site’s mailbox for individual messages.
Common mistakes to avoid
- Using a free Gmail or Yahoo address as From. Your server is not allowed to send for those domains, and the mail fails by design.
- Setting From to the visitor’s address. Use Reply-To for that.
- Fixing only the test email. A form plugin or WooCommerce can override the From address. Test a real form and a real order.
- Leaving the password in the database. Put it in
wp-config.php. - Forgetting the mailbox fills up. Sent copies and bounces collect in it. Check it now and then, or have it forward bounces to you.
A mailbox on your own domain
If the site has no real mailbox to send through yet, SiteHarbour business email gives you mailboxes on your own domain with IMAP, POP3 and SMTP, and our team sets up SPF, DKIM and DMARC for the domain when the mailboxes are created. That covers step 2 and step 5; the plugin settings in step 3 are then the only thing left to do in WordPress.
Frequently asked questions
Why did my WordPress emails work before and stop now?
Gmail, Yahoo and Outlook have tightened their rules in recent years, and unsigned mail that was once accepted is now filtered. Nothing changed on your site; the bar moved.
Do I need a paid SMTP service?
Not for a normal site. A mailbox from your email host handles contact forms, orders and password resets comfortably. A dedicated sending service makes sense only for thousands of messages a day.
Can I use my Gmail account as the SMTP server?
You can, with an app password, but the mail then comes from a gmail.com address rather than your domain. For a business, a mailbox on your own domain looks better and is easier to authenticate.
Will this fix emails that never arrive at all?
Usually, yes. Mail that is not delivered at all has normally been rejected for the same reasons, only more strictly. The plugin’s log will show the server’s exact answer for each message.
Does the SMTP plugin slow my site down?
No. It only runs when the site sends an email. Sending through SMTP takes a second or so longer than the default method, which visitors do not notice.
The short version: send WordPress mail through a real mailbox with SMTP, keep the From address on your own domain and put the visitor in Reply-To, and confirm that SPF, DKIM and DMARC all say pass in Gmail’s “Show original”.