Why do WordPress and WooCommerce emails go to spam or never arrive?

Because by default WordPress sends mail itself, through the web server, using PHP mail — with the From address wordpress@yourdomain, no DKIM signature, and SPF evaluated against your web host's server rather than your mail provider. WordPress core's own documentation admits some hosts block that default address outright. Receivers in 2026 grade unauthenticated mail accordingly: spam folder or rejection. The fix is to route the site's mail through the service that hosts your domain's real email (or a transactional sender), using a plugin such as WP Mail SMTP, so the mail inherits that provider's authentication.

Why do my contact form emails fail DMARC even with an SMTP plugin installed?

Usually because the form is configured to send 'from' the visitor's own email address. Your site cannot authenticate mail claiming to be from the visitor's domain — that is forgery by construction and DMARC correctly fails it. Contact Form 7's own best-practice documentation states the rule: the From field must use an address on the same domain as the site; the visitor's address belongs in Reply-To (via Additional headers), which is also the pattern WooCommerce itself uses for store notifications.

Is WP Mail SMTP free enough for a small store?

It depends where your domain's real mail lives, per the vendor's own mailer table. The free Lite version includes Google/Gmail (with a manual Google Cloud setup the vendor estimates at 30 to 60 minutes), SendGrid, Brevo, Postmark, Mailgun, SMTP.com and a generic SMTP option. Microsoft 365/Outlook, Amazon SES and Zoho Mail mailers are Pro-only, as are email logging and failure alerts. Pro's introductory price is $49 for the first year, renewing at $99 — the mailer matrix, not the marketing page, is what to check against your setup.

WordPress · WooCommerce · Email delivery

WordPress emails landing in spam — or vanishing? Your web server is not a mail server

First published 20 October 2026 · Mechanics and product facts below are from WordPress core documentation, Contact Form 7's and WooCommerce's official docs, and WP Mail SMTP's own mailer/pricing pages — checked for this guide.

THE TELL From: wordpress@yourdomain · No DKIM row · First Received: your web host

Open any “lost” order email in Gmail's Show original: if the first hop is your hosting server and there is no DKIM line at all, the site sent it itself — unauthenticated, from an address WordPress core's own docs admit “some hosts will block.” That is the default you are fixing.

Sender: your web serverFix: send as your mail provider

The fast answer

Scope test first: request a password reset. If that vanishes too, the whole site's mail is broken (this guide). If resets arrive but only order mail fails, check WooCommerce → Settings → Emails per-template settings after this fix.
Install WP Mail SMTP and choose the mailer that matches where your domain's real email lives — Google Workspace → Google mailer; Microsoft 365 → Microsoft mailer; neither → a transactional service (SendGrid/Postmark/Brevo/Mailgun) with domain authentication completed in that service.
Obey the From law: From = an address on the site's own domain (set the plugin's Force From Email on); visitors and customers go in Reply-To, never From.
Verify in headers, not in the plugin's test alone (details below): a real order email must show dkim=pass with d= your domain and dmarc=pass.

Why “the host handles email” is the trap

Default WordPress mail leaves via PHP from the hosting server. Its SPF verdict is about your host's IP, it carries no DKIM signature at all, and its From defaults to wordpress@ — an address that may not even exist as a mailbox. WP Mail SMTP's own FAQ describes such mail as sent “without any authenticating information.” Meanwhile the enforcement era (Gmail's and Yahoo's sender requirements) grades exactly that profile. Your host's marketing page saying “email included” describes a feature's existence, not its deliverability.

The mailer decision — and the free/paid truth

Where your real mail lives	Mailer	WP Mail SMTP tier (vendor's table)
Google Workspace	Google / Gmail	Lite (free) — but the manual Google Cloud OAuth setup is the vendor-estimated 30–60 minute route; the one-click setup is Pro.
Microsoft 365	Microsoft 365 / Outlook	Pro only. (Prefer its Microsoft Graph connection over legacy SMTP AUTH — tenant defaults around basic auth have tightened repeatedly; the Graph mailer is the durable path.)
Amazon SES	Amazon SES	Pro only — and SES itself starts in sandbox: production access must be approved, and domain verification (3 CNAMEs) comes first.
No provider / separate sending service	SendGrid, Postmark, Brevo, Mailgun, SMTP.com, generic SMTP	Mostly Lite. Caveat that decides success: complete domain authentication inside that service, or you get `dkim=pass` on their domain and DMARC still fails.

Pricing honesty, from the vendor's page: Pro is $49 for the first year and $99 at renewal; email logging and failure alerts are also Pro features. Pick the tier by the mailer matrix and by whether you'll need to see failures — invisible failures are how stores lose orders silently for months.

The alignment truth the plugin pages understate

The plugin changes the route; alignment is inherited — conditionally:

Sending via Workspace aligns SPF through your domain's Google include, and DKIM only if you turned DKIM on in Google Admin (our setup guides cover it). Skip that, and the site's mail signs as Google, not you.
Sending via Microsoft 365 aligns DKIM only if custom-domain DKIM is enabled in Defender — off by default (our DKIM guides). This is Article #1's onmicrosoft.com trap wearing a WordPress costume.
Sending via a transactional service aligns only after its domain-authentication flow. The plugin connected ≠ the domain authenticated.

The From law (forms included)

In the plugin, set From Email to a real address on the site's domain and enable Force From Email — without it, individual plugins keep their own senders, and the plugin's test email (which uses the plugin's From) passes while real notifications still fail. That gap is a classic false summit.
In every form plugin, From = the site's address; the visitor's address goes in Reply-To (Contact Form 7: the Additional headers field). CF7's own best-practice doc states the rule verbatim: in the From field, “use an email address that belongs to the same domain as the site.” WooCommerce already models it — store notifications put the customer in Reply-To, never From.
A real wordpress@ mailbox (or the From address you chose) should exist: bounces and replies need somewhere true to land.

Prove it worked — three gates

Plugin test email arrives, and its headers show the provider as the first hop — not your web host.
Header gate on a real message: place a real (test) WooCommerce order with an outside address. Show original must read dkim=pass with d= = your domain and dmarc=pass. A dkim=pass naming the service's domain means domain authentication inside that service is unfinished.
Form gate: submit your contact form as a visitor; the notification arrives, and hitting Reply addresses the visitor — the From law working as designed.
If your tier includes logging, turn it on: the store that can see failures stops discovering them from angry customers.

FAQ

My host offers “SMTP” in cPanel. Same thing?

Sending via the host's own SMTP still authenticates as the host, not as your mail provider — and shares reputation with every other site on the server. The mailer must be the provider (or a transactional service with your domain authenticated), not merely “SMTP instead of PHP.”

Everything passes now, but order emails still occasionally folder.

Transactional mail rides your domain's overall reputation: marketing sins (unauthenticated tools, complaint spikes) tax order mail. The authentication layer is now sound; the remaining levers are the list and engagement hygiene covered in our Yahoo guide.

Can I just add my host's IP to SPF instead?

That can make SPF pass for server-sent mail, but there is still no DKIM signature from your domain — one forwarding hop from failure, and graded as the weakest form of authenticated by receivers. It's a plaster, not the repair.

Sources

WordPress Developer Resources — wp_mail and its default From behaviour (core source comment) · Contact Form 7 — official best-practice documentation on From/Reply-To · WooCommerce — email settings documentation · WP Mail SMTP — mailer documentation, free-vs-Pro mailer table, pricing page, FAQ · Amazon SES documentation (sandbox/production access, domain verification).

Verification note: mailer availability by tier, the renewal pricing, the Google setup-time estimate and the From guidance above were confirmed from the vendors' and projects' own pages on 20 October 2026. Per-service DNS record shapes are deliberately not printed: they are generated inside your own account at that service, and copies from any guide (including this one) would be wrong.

Did this fix work for you?

Your reaction tells us whether this guide solved the problem it promised to solve.