A customer calls to say they haven’t received an order confirmation, or you discover that messages from your contact form have been ending up in the spam folder for weeks. Emails sent from WordPress often don’t arrive because they’re sent via the PHP mail function without authentication. Resolve this by using SMTP or a transactional email service and ensuring your domain has correct SPF, DKIM, and DMARC records. Below, you’ll learn how to identify the cause, set up SMTP, and ensure recipients recognize your domain as a trustworthy sender. The background information is provided in How Domains, DNS, and Email Are Connected.
Why WordPress Emails Don't Get Delivered
WordPress emails aren't being delivered because, by default, WordPress sends them without logging into an email server. The feature wp_mail() uses the web server’s PHP mail function, which simply sends the message out. Gmail and Outlook then see an email that appears to come from your domain, but that doesn’t originate from a server authorized to send email on behalf of that domain. Think of it like a letter with no sender and no postmark. It ends up in the pile of suspicious mail—which, in the case of email, is the spam folder—or the email is rejected entirely.
I usually see one of four causes, often in combination. The first is that WordPress isn’t logging in to a mail server. The second is a sender address that doesn’t belong to your own domain, such as a Gmail address or the visitor’s address. Third, SPF, DKIM, or DMARC are missing from your domain, or they’re incorrect. And finally, many hosting providers restrict outgoing email via PHP to prevent a hacked site from sending spam.
First, check: where is the problem?
The quickest way to find the cause is to follow a set troubleshooting sequence before you start installing plugins. This is the sequence I follow myself.
- Check the recipient's spam folder.
- Send a test email, for example, using the test feature of your SMTP plugin or the Check Email plugin.
- Enable an email log to see if WordPress is actually sending the email.
- Check the sender's address under Settings > General and in your form plugin.
- Test your domain on internet.nl or with Mail-Tester.
The email log often tells you right away what’s wrong, if you know what the error messages mean. If it says that authentication failed, then either the password is incorrect or your provider is asking for an app password. A connection timeout indicates an incorrect port or a port that’s blocked. And the code 550 5.7.1 means the recipient doesn’t recognize your server as an authorized sender. My rule of thumb is simple. If the email ends up in the spam folder, you have an authentication problem; if it isn’t sent at all, the issue lies in the configuration.
Sending WordPress Emails via SMTP
SMTP (Simple Mail Transfer Protocol) is the protocol that an email program uses to connect to an email server in order to send messages. With an SMTP plugin, WordPress does exactly the same thing as Outlook on your laptop. There are three options, and which one is right for you depends on how much email your site sends.
Option 1: via your own domain's mailbox
- Install an SMTP plugin, such as WP Mail SMTP, FluentSMTP, or Post SMTP.
- Enter your email provider's SMTP server.
- Select port 587 with STARTTLS, or port 465 with SSL if 587 doesn't work.
- Enter the username and password for an existing mailbox.
- Lock the sender's address, for example, using Force From Email in WP Mail SMTP, so that other plugins don't overwrite it.
- Send a test email.
To do this, you'll need an email account on your own domain, for example through email hosting. This setup works well for a website with a contact form and minimal email traffic. A Surver mailbox can send up to 75 emails per hour.
Option 2: via a transactional email service
Transactional email is automated email sent in response to a visitor’s action, such as an order confirmation, a password reset, or a form submission confirmation. A specialized service delivers these more effectively because it builds a solid sending reputation, keeps logs, and properly handles bounces (undeliverable emails). Well-known examples include Brevo, Mailgun, and Amazon SES. My opinion on this is quite firm: An online store should not send order confirmations using the standard PHP mail function; a transactional email service is not a luxury but a necessity.
Option 3: via Google Workspace or Microsoft 365
If you're already using Google Workspace or Microsoft 365 for your business email, WordPress can also send email through that platform. You'll need an OAuth connection or an app password, and you'll be subject to their sending limits. Both packages, Google Workspace and Microsoft 365, which, by the way, you can also purchase through Surver. You can read about how to weigh the options in Email hosting, Google Workspace, or Microsoft 365.
SPF, DKIM, and DMARC: How the Recipient Verifies Your Domain
SPF, DKIM, and DMARC are three TXT records in your DNS that tell recipients whether an email is actually from you. You can read about how DNS works in What is DNS?, and the function of TXT records is described in DNS Records Explained. SPF is a DNS record that specifies which servers are authorized to send email on behalf of your domain. Think of it as the guest list at the door. An example is v=spf1 include:_spf.example-service.nl ~all. DKIM is a digital signature included in every email, which the recipient verifies using a public key in your DNS. You receive that key from your email service provider.
DMARC is a DNS record that tells the recipient what to do if SPF or DKIM fails, and where to send reports. A secure start is v=DMARC1; p=none; rua=mailto:dmarc@jouwdomein.nl. When setting this up, I keep seeing the same mistakes. People create a second SPF record instead of extending the existing one, even though there can only be one. Or they forget to add the sending service to the SPF record. What’s less well known is that SPF is limited to 10 DNS lookups, so anyone who adds a lot of services using the “include” directive will end up with an invalid record without realizing it. And never set up DMARC right away p=reject. Start with p=none, review the reports, and then escalate to quarantine and reject. You can track your reputation with Gmail in Google Postmaster Tools.
Setting Up Contact Forms and WooCommerce Emails Correctly
Form and order emails are most effectively delivered when they’re sent from an address on your own domain. For a contact form, enter the visitor’s address in the “Reply-To” field, not the “From” field. If the form sends emails on behalf of the visitor, DMARC will fail by definition, because your server is not authorized to send emails on behalf of their domain. Be sure to include a CAPTCHA as well, because spam sent through your form damages your domain’s reputation. Read more at Setting Up a Contact Form in WordPress.
In WooCommerce, you can check the sender's name and address under WooCommerce > Settings > Emails. After making any changes, place a test order and check whether the order confirmation and invoice arrive in both Gmail and Outlook. If you'd like to have this checked periodically, you can do so via WooCommerce Management.
At Surver, we have our own solution for this. Our transactional email It's called Dropper, and you can purchase it as an add-on to your hosting package, for example from Managed WordPress Hosting. If your online store or form exceeds the 75 emails per hour limit of a standard email account, Dropper is the way to go. If you still have questions about your records after that, our support team will be happy to help. If you’d rather outsource the setup and maintenance of your site entirely, check out WordPress Maintenance and Management.
Frequently Asked Questions
Do I need an SMTP plugin?
Yes, for virtually any site that sends form or order emails. The only exception is if your email already goes through an authenticated transactional service that handles the sending itself.
Is SMTP for WordPress free?
If you use your own domain's mailbox, there's no extra cost, and SMTP plugins have free versions. If you send more emails—at Surver, more than 75 per hour per mailbox—you'll need a transactional email service.
Is DMARC mandatory?
It's not required by law, but Gmail and Yahoo have required it since 2024 for senders who send large volumes of email. My advice is to always have at least one DMARC record with p=none so that you receive reports and can see who is sending emails on behalf of your domain.
