A customer places an order and never gets a confirmation. Someone requests a password reset and waits. A lead fills in your contact form, sees "thank you," and you never hear about it.
Meanwhile WordPress reports everything as sent. Your form plugin shows a success message. Nothing looks broken.
This isn't a WordPress bug, and it isn't your host being careless. It's a structural mismatch between how WordPress sends mail by default and what mailbox providers have required since 2024 — and the fix takes about twenty minutes once you know what you're doing.
The short version
WordPress uses PHP's mail() function by default, which sends unauthenticated mail directly from your web server. That fails modern requirements almost by design.
The fix is SMTP — routing your site's mail through a real sending service that authenticates properly.
But first, work out which problem you have, because they need different responses:
| Symptom | Problem |
|---|---|
| Nothing arrives at all | Sending failure — PHP mail blocked or misconfigured |
| Arrives in spam | Deliverability — authentication or reputation |
| Arrives for some recipients only | Usually authentication alignment |
| Form says sent, nothing received | Often a From-address problem |
Why PHP mail fails, structurally
WordPress's wp_mail() function defaults to PHP's mail(), which hands the message to whatever mail transfer agent exists on your web server.
Four reasons that fails now:
No authentication. Mail sent this way typically has no proper DKIM signature and often fails SPF, because the web server isn't in your SPF record. Since 2024, Gmail, Yahoo, and Microsoft require authentication — and failures mean rejection, not just filtering.
A web server's IP has no sending reputation. It's a machine that serves web pages. Providers have no history of it sending legitimate mail, and shared hosting IPs are frequently already tainted by other sites on the same box.
Many hosts block it outright. PHP mail() is a common spam vector, so plenty of hosts disable it. Your site cheerfully reports success while nothing leaves the server.
No visibility. No logs, no bounce handling, no delivery confirmation. You find out from a customer.
The verdict: PHP mail was fine in 2010. It isn't a viable transport in 2026, and no amount of configuration makes it one.
Two different problems
Before fixing anything, establish which you have. The responses are completely different.
Nothing arrives at all. A sending failure. Mail isn't leaving your server, or it's being rejected outright. SMTP fixes this.
Mail arrives, but in spam. A deliverability problem. The mail is being sent and accepted — the receiving provider is choosing to filter it. SMTP helps, but you also need proper domain authentication and, sometimes, reputation repair. The wider picture.
How to tell: install an email logging plugin, or check your sending service's logs after switching to SMTP. If the log shows "sent" and the recipient has nothing in inbox or spam, it's a sending failure. If it's in their spam folder, it's deliverability.
Transactional and marketing mail need separate paths
This is the strategic point most WordPress guides skip, and it matters more than the SMTP plugin you choose.
Transactional mail — receipts, password resets, order confirmations, form notifications — is genuinely wanted. Open rates approach 100%. Nobody reports a password reset as spam.
Marketing mail — newsletters, promotions — is optional, and it generates complaints and unsubscribes even when done well.
If both flow from the same domain, one bad campaign can damage the reputation your receipts depend on. Providers score reputation per domain and subdomain, so mixing streams means a promotional misstep can delay or junk the order confirmations your business runs on.
There's a subtler trap too: if someone unsubscribes from marketing but keeps receiving mixed-stream mail from the same address, providers can read that as ignoring the unsubscribe.
The standard architecture:
| Stream | Domain | Examples |
|---|---|---|
| Corporate / human | yourbrand.com |
Sales replies, support conversations |
| Marketing / bulk | news.yourbrand.com |
Newsletters, promotions |
| Transactional | notify.yourbrand.com |
Order confirmations, password resets |
Each subdomain gets its own complete SPF, DKIM, and DMARC setup and builds its own reputation, while still inheriting brand recognition from the root.
One honest caveat: subdomain separation contains damage but isn't a firewall. Providers do consider the root domain's overall behaviour. It reduces blast radius; it doesn't grant immunity.
Setting up SMTP
The mechanical fix, and it's straightforward.
1. Choose a transactional email service. Postmark, Brevo, Mailgun, SendGrid, or Amazon SES. Most have free tiers sufficient for a small site's transactional volume. Compared properly.
2. Install an SMTP plugin. WP Mail SMTP, FluentSMTP, or Post SMTP. They intercept wp_mail() and route it through your chosen service instead of PHP mail.
3. Authenticate your sending domain with the service — publishing the DNS records it gives you.
4. Configure the plugin with your service's credentials.
5. Send a test and verify it arrives.
Authenticating the sending domain
SMTP alone isn't sufficient. Your sending domain still needs proper authentication, or your mail is authenticated to your provider rather than to you.
Three records:
SPF lists which servers may send for your domain. Your transactional provider goes in it — and remember you can only have one SPF record per domain, with a limit of 10 DNS lookups.
DKIM signs each message cryptographically. Your provider gives you the records to publish.
DMARC ties them together and tells receivers what to do on failure. Start at p=none.
The detail that catches everyone: alignment. SPF and DKIM can both pass while DMARC still fails, because the domain in your visible From address doesn't match the domain that was actually authenticated. If your provider signs under its own domain rather than yours, you'll see green ticks and failing mail.
WooCommerce order emails
Stores have the sharpest version of this problem, because a missing order confirmation is a support ticket and a refund request rather than an inconvenience.
The specific issues: high volume compared to a brochure site, emails containing money amounts and links (which filters scrutinise), a From address that's often [email protected] by default, and customers who'll contact you rather than check their spam folder.
Contact form notifications
The most commonly misdiagnosed WordPress email problem, and it usually has nothing to do with your host.
The mistake: setting the notification's From address to the visitor's email address, so the message "looks like it's from them."
That means your server is sending mail claiming to be from [email protected] — which is exactly the forgery pattern SPF and DMARC exist to stop. Gmail publishes a DMARC policy, your server isn't authorised to send as Gmail, and the message fails.
The fix: From should be your own domain. Put the visitor's address in Reply-To, which gives you the same convenience without the forgery.
Logging: so you can prove what happened
The step people skip, and the one that turns a mystery into a five-minute diagnosis.
Most SMTP plugins include email logging. Turn it on.
What it gives you: a record of every email your site attempted to send, whether it was accepted, what the recipient address was, and the error if it failed.
Why it matters: when a customer says they never received their order confirmation, you can see whether it was sent, when, and to what address. Very often the answer is that they typo'd their email at checkout — which is a completely different conversation from "our system is broken."
A caution: email logs contain personal data, so consider retention. Thirty days is usually plenty, and most plugins let you set automatic pruning.
Your transactional provider's dashboard also holds delivery data — often including bounces and opens — which is more authoritative than your site's own log.
The order to do this in
- Confirm which problem you have — not sending, or sending into spam
- Pick a transactional service and create an account
- Install an SMTP plugin and connect it
- Authenticate the sending domain — SPF, DKIM, DMARC, and check alignment
- Send a test and verify it lands in the inbox
- Turn on logging
- Test the real flows — place a test order, request a password reset, submit your contact form
- Consider subdomain separation if you also send marketing mail
Steps 1 to 6 take about twenty minutes. Step 7 is the one people skip and shouldn't — testing the plugin's built-in test email proves the connection works, not that WooCommerce is using it.
Frequently asked questions
Why are my WordPress emails not sending?
Because WordPress defaults to PHP's mail() function, which sends unauthenticated mail directly from your web server. That fails modern provider requirements — since 2024 Gmail, Yahoo, and Microsoft require proper authentication, and a web server's IP has no sending reputation. Many hosts also block PHP mail entirely as a spam-prevention measure, in which case your site reports success while nothing actually leaves. The fix is routing mail through a real sending service via SMTP.
Do I need an SMTP plugin?
Effectively yes, for any site that sends mail people depend on receiving. WordPress has no built-in way to authenticate outgoing mail properly, so an SMTP plugin connecting to a transactional service is the standard solution. The alternative is configuring it at server level, which some managed hosts do for you — worth checking before installing anything, since if your host already routes mail through an authenticated service, you may not need the plugin.
Why do WooCommerce emails go to spam?
Usually a combination: PHP mail with no authentication, a default From address like [email protected] that doesn't match a real mailbox, and order emails containing prices and links that filters scrutinise more closely. Stores also send more volume than brochure sites, so problems surface faster. The fix is SMTP through a transactional service, a proper From address on your own domain, and full SPF, DKIM, and DMARC authentication.
Should marketing and transactional mail share a domain?
Ideally not. Providers score reputation per domain and subdomain, so a bad promotional campaign can damage the reputation your order confirmations depend on. The standard architecture puts marketing on one subdomain, transactional on another, and human mail on the root, each with its own complete authentication. Worth knowing this contains damage rather than preventing it entirely — providers still consider the root domain's overall behaviour.
What to do next
Send yourself a password reset from your own site. If it doesn't arrive within a couple of minutes, you've confirmed the problem in about thirty seconds.
Then check what your site's From address currently is. If it's [email protected] and that mailbox doesn't exist, that's contributing — and it's a two-minute fix in your SMTP plugin's settings.
Free: The 60-Minute Email Authentication Fix — verify SPF, DKIM, DMARC, and alignment on your own domain.
Go deeper: The Email Deliverability Playbook — the full domain architecture model and the authentication setup for every provider.
Related guides
- How to set up SMTP in WordPress — the configuration walkthrough
- WooCommerce order emails going to spam — store-specific
- Contact form emails not arriving — the From-address trap
- Transactional email services compared — choosing a provider
- Email authentication: SPF, DKIM, DMARC — the records in detail
- Why authenticated emails still land in spam — if SMTP alone doesn't fix it
Join the Newsletter
Get practical marketing tactics delivered straight to your inbox.
Written by
Muhammad Basim
Related Articles
Transactional Email Services Compared for WordPress
Every one of these services will deliver your password resets. That's not the differentiator. What differs is setup difficulty, what the free tier covers, how good the logs are when something goes wrong, and — the one people never consider until it bites them — whether the service also handles marketing mail, and whether you […]
Contact Form Notifications Not Arriving: Every Cause
Here's the version of this problem that costs the most: it's been happening for months and you don't know. The form says "thank you." The visitor believes they've reached you. You believe nobody's been in touch. There's no error, no bounce, no alert — just an absence, and absences are invisible. Most of the time […]
WooCommerce Order Emails Going to Spam: The Fix
"I never got a confirmation. Did my order go through?" Every store owner gets this message. And when it arrives often enough, you stop treating it as customer confusion and start realising your receipts genuinely aren't landing. This costs more than most email problems, because a missing order confirmation doesn't just annoy someone — it […]