Why WordPress emails go to spam, and how to fix it
Order receipts and form alerts landing in spam, or not arriving at all? Here is why it happens on WordPress sites and the checks that fix most of it.
You set up a contact form, a customer places an order, someone asks for a password reset. WordPress sends an email, and then nothing. Or it turns up in the spam folder, next to the offers for things nobody asked for.
It is one of the most common WordPress complaints, and it is rarely random. There are a handful of causes, and most can be fixed without touching code. This post walks through them in plain English, in the order we would check them.
How a WordPress email actually gets sent
When a plugin or WordPress itself needs to send an email, it calls a built-in function named wp_mail. Contact forms, WooCommerce order emails, membership notices and password resets all use it.
Out of the box, wp_mail hands the message to PHP's mail() function, which passes it to whatever mail software your web host runs. Nothing in that chain proves the email is really from you. It is a bit like posting a letter with your return address written in pencil by someone else.
Receiving servers such as Gmail, Outlook and Yahoo have learned to be suspicious of that. They are not being unfair: forged and unauthenticated mail is exactly what spammers and phishers rely on.
The usual causes
1. Nothing proves the email came from your domain
Inbox providers check three things: SPF, DKIM and DMARC. In short, these are records in your domain's DNS that say who may send for you and that the message was not tampered with. Our plain-English guide to SPF, DKIM and DMARC covers each one.
This is no longer optional. Since 2024, Google's email sender guidelines and Yahoo's sender best practices have asked all senders to authenticate, and bulk senders to use SPF, DKIM and DMARC with a From address that lines up with the domain. Google defines bulk as more than 5,000 messages a day to Gmail addresses. A small shop is well under that, but the same checks still shape how its mail is judged.
2. The From address does not match the server
By default, WordPress sends from wordpress@yourdomain.com. That address often does not exist, and your host's mail server may not be authorized to send for your domain. Some plugins make it worse by putting the visitor's address in the From field of a form notification, for example a Gmail address your site has no right to send as.
The fix is to send from a real address on your own domain, like orders@yourstore.com, and put the visitor's address in Reply-To instead.
3. Shared hosting reputation
On shared hosting, hundreds of sites may send through the same server. If one of your neighbors sends junk, the server's reputation suffers and your receipts pay for it. You cannot see this from inside WordPress, which is a good reason to stop depending on the host's mail server.
4. The host blocks or limits mail()
Some hosts switch off mail() entirely, or cap how many messages you can send an hour. In that case emails vanish without any error.
5. Plugin conflicts
Two plugins both trying to handle email can step on each other. Common culprits:
- An old SMTP plugin that still has outdated settings saved.
- A security or caching plugin that blocks the request that sends email.
- A form plugin set to send from an address that does not belong to you.
6. The email itself looks suspicious
Spam filters read the message too. Very short emails that are only a link, emails that are all images, a missing plain-text version, or a subject line in capital letters with several exclamation marks all count against you. Marketing messages without an easy way to unsubscribe do too. Google and Yahoo both ask for one-click unsubscribe on marketing mail.
7. People mark your mail as spam
If customers do not remember signing up, they will click Report spam. Google's guidelines tell bulk senders to keep their spam rate under 0.3%, and recommend staying well below that. Even for small senders, complaints are the fastest way to damage a domain's reputation.
A checklist you can do today
- Look at the From address. Send yourself a test email, open the message details and see what address it came from. It should be on your own domain.
- Send a password reset to your own address. Log out, use Lost your password, and see where it lands. Try a Gmail address and one other provider if you can.
- Check spam folders at the receiving end, and mark the message as Not spam so that provider learns.
- Find out who hosts your DNS. It is often your registrar, your host or a service like Cloudflare. You will need to log in there to add records.
- Check which records exist. Look for a TXT record starting
v=spf1, a DKIM record, and a TXT record at_dmarc. If any are missing, that is your first job. - Deactivate duplicate email plugins. One plugin should handle sending.
- Review your forms. Make sure notifications use your domain in From and the visitor in Reply-To.
- Check your host's mail limits. Search your host's help pages for "mail limit" or "disable mail".
- Keep a record. If you can see what was sent and what happened, you can fix problems in minutes instead of guessing. We wrote about this in why your WooCommerce and form emails need a log.
If a password reset is the problem you are chasing, there is a dedicated list in password reset emails not arriving.
A note on "delivered"
Even a perfectly set up site cannot promise the inbox. "Delivered" only means the receiving server accepted the message. What happens next, inbox, a Promotions tab or spam, is the recipient's provider's decision, and no sender can see it. Good authentication and sensible content simply give your email its best chance.
Where SendWP fits
The SendWP plugin takes over the email WordPress already sends through wp_mail, so forms, WooCommerce and password resets all go through it. Mail is sent from your own domain and signed with DKIM, and SendWP spells out your SPF and DMARC records and checks them for you. There are no SMTP settings to fill in.
You also get an email log with at least 30 days of history, so you can see whether a message was sent, bounced, failed or blocked. Plans start at $9 a month, with the first month $1 on monthly plans. See getting started or pricing.
