If WordPress isn’t sending emails, or they land in spam, the cause is almost always the same: by default WordPress hands email to your web server to send, and web servers are bad at delivering email. The fix is to send through a proper email service instead.
This affects everything your site sends: password resets, new user notifications, contact form notifications and store order emails. Here is how to fix it properly.
Why WordPress email fails
WordPress sends mail with a function called wp_mail(). Out of the box, that passes the message to PHP’s mail() function on your server. Several things can go wrong from there:
- Your host blocks or limits it. Many hosts disable or throttle server mail to stop spam, so messages are silently dropped.
- The mail fails authentication. WordPress sends from an address like
[email protected], but your server isn’t listed as allowed to send for your domain. Gmail, Outlook and others treat that as suspicious. - The server has a poor reputation. Shared servers send mail from IP addresses used by many other sites. If one of them sends spam, everyone’s mail suffers.
- The From address is wrong. Some form plugins send notifications “from” the visitor’s own email address. Your server isn’t allowed to send for gmail.com, so those messages often get rejected.
WordPress usually can’t tell you any of this. wp_mail() only reports whether the server accepted the message, not whether it was delivered.
The fix: an SMTP plugin and a transactional email service
The reliable setup has two parts: a plugin that routes WordPress email through a real email service, and the email service itself.
Install an SMTP plugin
An SMTP plugin replaces the default mail() sending with a properly authenticated connection to an email provider. Two well-known, well-maintained options are WP Mail SMTP and FluentSMTP. Both connect to the main providers, send test emails, and can log what your site sends.
Use one SMTP plugin only. Two plugins both trying to take over email will conflict.
Choose a transactional email provider
A transactional email service is built to send automated, one-to-one messages like password resets and order receipts. Well-known options include Postmark, Amazon SES, Mailgun, SendGrid and Brevo. Many have a free or low-cost tier that covers a typical small business site.
You can also send through Google Workspace or Microsoft 365 if you already use them, which is fine for low volume. A dedicated transactional service is usually the better choice for stores and busy forms, because it is designed for that job and gives you delivery logs.
Avoid using your regular newsletter tool for this. Marketing and transactional mail should be kept separate.
Connect the two
- Create an account with your chosen provider and add your domain.
- Add the DNS records the provider gives you (more on these below) and wait for the provider to verify them.
- Create an API key in the provider’s dashboard. Most SMTP plugins prefer an API connection over a username and password.
- In your SMTP plugin’s settings, choose your provider, paste the API key, and set the From Email to an address on your own domain, such as
[email protected]or[email protected]. - Set a sensible From Name, usually your business name.
Many SMTP plugins can force the From address so every email uses it, even if a form plugin tries to set something else. Turning that on prevents a lot of rejected mail.
Set up SPF, DKIM and DMARC
These three DNS records prove to receiving mail servers that your email is genuine. Your email provider will tell you the exact values. You add them wherever your domain’s DNS is managed, which may be your domain registrar, your host, or Cloudflare.
SPF
SPF is a TXT record that lists which services may send email for your domain. A domain must have only one SPF record. If you already have one, for example for Google Workspace, add the new provider to it instead of creating a second record. A combined record looks like this:
v=spf1 include:_spf.google.com include:provider-domain.example ~all
Use the exact include: value your provider gives you. Two separate SPF records will cause SPF to fail.
DKIM
DKIM adds a digital signature to each message. Your provider gives you one or more CNAME or TXT records to add. Once they are verified, mail from your site is signed and much less likely to be flagged.
DMARC
DMARC tells receiving servers what to do with mail that fails SPF and DKIM, and where to send reports. Gmail and Yahoo now require it for bulk senders, and it helps every sender. If you don’t have one, start with a monitoring-only record. Add a TXT record with the name _dmarc and this value:
v=DMARC1; p=none; rua=mailto:[email protected]
p=none means “report only, don’t block anything”. Once you’ve confirmed all your legitimate email passes, you can move to p=quarantine or p=reject.
Test that it works
- Use your SMTP plugin’s test email feature. WP Mail SMTP and FluentSMTP both have one. Send a test to an address you can check, and to a Gmail address if you can.
- If the test fails, the plugin will usually show the error from the provider. The most common causes are a wrong API key or a domain that hasn’t finished verifying.
- Open the test email in Gmail, click the three-dot menu, and choose Show original. Check that SPF, DKIM and DMARC all say PASS.
- Trigger a real email: submit your contact form, or use the lost password link on your login page. Our guide on how to reset a WordPress password shows where that is.
- Turn on email logging in your SMTP plugin, so next time you can see exactly what was sent and when.
Other things to check
- Where notifications go. Core WordPress notifications go to the address in Settings → General → Administration Email Address. Form notifications use their own settings inside the form plugin, so check each form.
- Reply-To for forms. If you want to reply directly to people who fill in your forms, put the visitor’s email in the Reply-To field of the notification, not the From field.
- Plugin conflicts. If test emails work but one plugin’s emails don’t, that plugin may be sending in its own way. Our guide to plugin conflicts helps narrow it down.
- Site Health. Tools → Site Health won’t diagnose email directly, but it does flag general server problems. See our Site Health guide.
Keep it from happening again
Once email goes through a proper provider with SPF, DKIM and DMARC in place, it tends to stay working. The things that break it later are usually DNS changes during a migration, an expired API key, or a new plugin overriding the From address. Send a test email after any of those, and check your SMTP plugin’s log now and then.
Want someone to handle it?
If your site’s emails still aren’t arriving, or DNS records aren’t your thing, our $79 one-time fix will set up reliable sending and the DNS records for you. It’s fixed or your money back, usually within 24 hours. If you’d rather have someone watching your site’s health all the time, our Care Plans start at $69 a month.