It’s one of those problems that tends to get noticed at the worst possible moment. A customer messages to say they never received their order confirmation. A contact form enquiry doesn’t get a reply because your response landed in their junk folder. A campaign goes out and the open rate is half what it was three months ago.
WordPress email deliverability problems are extremely common and almost always fixable. But they need to be understood properly before anything gets touched. The number of times we’ve seen someone “fix” a deliverability problem by installing a caching plugin, or by changing their WordPress from address to a Gmail account, is higher than it should be.
WordPress wasn’t built to send email out of the box
WordPress can send email. It does so using PHP’s built-in mail function, which hands the message off to whatever mail transfer agent is running on your server. On most shared hosting environments, this works – in the sense that the email leaves the server. Whether it arrives anywhere useful is a different question.
The problem is that email sent this way has no authentication. There’s nothing attached to it that proves to the receiving mail server that the message actually came from your domain, that you authorised it, or that your sending infrastructure is legitimate. It just arrives looking, frankly, a bit suspicious.
Modern email providers such as Gmail, Microsoft and Yahoo have become significantly stricter about this over the past couple of years. In February 2024, Gmail and Yahoo introduced new requirements for bulk senders that made proper email authentication non-negotiable if you want reliable delivery. Even if you’re not a bulk sender, these standards are increasingly applied to all email.
The result: emails that used to arrive fine are now going to spam, or being silently rejected.
What email authentication actually means
Three DNS records tell receiving mail servers your email is legitimate: SPF, DKIM and DMARC.
SPF (Sender Policy Framework) is a DNS record on your domain that lists the servers and services authorised to send email on your behalf. When a receiving server gets an email from your domain, it checks whether it came from an authorised source. If it didn’t, that’s a red flag.
DKIM (DomainKeys Identified Mail) is a cryptographic signature attached to outgoing email. It proves that the message hasn’t been tampered with in transit and that it genuinely came from your domain. Think of it as a wax seal on a letter.
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells receiving servers what to do if either check fails – reject, quarantine (send to spam), or do nothing. It also gives you reporting so you can see what’s happening to email sent from your domain.
If any of these records are missing, incorrect, or in conflict with each other, your email is going to have a harder time arriving.
Most WordPress sites we look at are missing at least one of these, and often all three. Not because whoever set the site up was careless, but because WordPress doesn’t configure them for you and most hosting providers don’t either.
The second problem: WordPress is using the wrong sending method
Even with authentication records in place, email sent via PHP mail from a shared hosting server has an inherent problem: the sending IP address.
On shared hosting, your site shares a server – and therefore an IP address – with dozens or hundreds of other websites. If any of those sites send spam (intentionally or because they’ve been compromised), the IP’s reputation suffers. And that reputation affects every site on the server, including yours.
The clean solution is to route your WordPress email through a dedicated SMTP relay – a service that exists specifically for sending email, with its own verified infrastructure, maintained sending reputation and proper authentication built in.
Services like Amazon SES, Mailgun, SendGrid and others exist for exactly this purpose. You configure WordPress to send through them rather than through PHP mail, and immediately your email is coming from a verified, reputable source rather than an anonymous shared server.
This is what the phrase “SMTP configuration” means when you see it in WordPress email advice. It’s not particularly complicated to set up, but it does need to be done correctly – especially the authentication records, which have to match the sending service you’re using.
WooCommerce email problems specifically
WooCommerce sends a lot of transactional email: order confirmations, shipping notifications, password resets, receipts. These are some of the most important emails your business sends, and they’re exactly the kind that customers notice if they don’t arrive.
WooCommerce uses WordPress’s built-in email function, which means it inherits all of the problems described above. Fix the underlying WordPress email setup and the WooCommerce emails fix with it.
There are a few WooCommerce-specific things worth checking as well:
The “from” address matters. WooCommerce sends email from whatever address is configured in its settings. If that address doesn’t match your domain – if it’s a Gmail address, for example – you’re immediately failing SPF checks. The from address should be a proper address at your own domain.
Reply-to is separate from from. You can set a different reply-to address if you want replies to go somewhere else. But the sending address should always be at your verified domain.
Test your WooCommerce emails. It’s worth sending test orders through your checkout and confirming that every email in the sequence – confirmation, processing, completed – is actually arriving. It’s surprisingly common for one step in the sequence to be misconfigured without anyone noticing.
Campaign email is a different conversation
If you’re sending newsletters or marketing campaigns and the open rates have dropped, the causes can overlap with the above but aren’t identical.
Campaign email deliverability depends heavily on your sending reputation over time – which is built from factors like your list quality, how engaged your subscribers are, your unsubscribe rate and whether people are marking your emails as spam. You can have perfect authentication records and still have poor deliverability if you’re sending to a stale list or if a significant proportion of your recipients are marking your emails as spam.
That said, authentication records and a clean sending setup are the foundation. If those aren’t right, nothing else matters.
One thing worth knowing: if you’re still on Mailchimp or a similar subscriber-count-based pricing platform, there are cheaper alternatives that give you more control. I set up a lot of clients on Sendy with Amazon SES – self-hosted email sending at a fraction of the per-subscriber cost. For a 10,000-subscriber list sending twice a month, the sending cost via SES is around £2. The equivalent on Mailchimp is closer to £100 a month. The setup takes a bit more work, but the economics are hard to ignore if you’re sending regularly.
How to know if this is your problem
The fastest way to check your current email setup is to run a test at mail-tester.com. Send an email to the address they give you from your WordPress site – via your contact form, or using a plugin like WP Mail SMTP’s test function – and you’ll get a score out of ten with a breakdown of exactly what’s passing and failing.
A score of 10/10 means your email is well-configured. A score of 5 or below usually means authentication records are missing or broken, or your sending IP has reputation issues.
If you’re running WooCommerce, also check Google Postmaster Tools – it’s a free Google service that shows you your domain’s email reputation and whether Gmail is seeing issues with your messages.
What a proper fix looks like
When I sort out a WordPress email deliverability problem, the typical sequence is:
- Check existing DNS records – SPF, DKIM, DMARC – and identify what’s missing or misconfigured
- Set up a proper SMTP relay (usually Amazon SES for the clients I work with, since I know it well and the economics are excellent)
- Configure WP Mail SMTP or a similar plugin to route WordPress email through the relay
- Update or add DNS records to match the relay’s authentication requirements
- Run a mail-tester.com test to confirm the fix worked, and share the result
Most of the time this takes around an hour. The DNS changes can take a few hours to propagate, but the actual work is usually quick once the problem is properly diagnosed.
If you’ve had someone look at this before and the problem came back, it’s almost certainly because the root cause wasn’t found. A clean mail-tester.com score is proof the fix worked.
Getting help
If your WordPress emails are going to spam, whether that’s WooCommerce transactional email, contact form replies or campaigns, get in touch. The audit of your email setup is free. We’ll look at what’s happening, tell you why, and fix it, with no diagnosis fee and no obligation.
Xinc Digital is led by me, Mark. I’ve spent over 20 years building and maintaining WordPress sites across hosting infrastructure, custom plugin development, WooCommerce, security, and performance. By now I’ve seen most of what can go wrong.
When you’re on a care plan, you work directly with me. I’m the person who knows your site, handles your updates and responds when something needs attention.
I also work with a group of developers I’ve collaborated with for years, so there’s always cover, and extra hands when a job needs them.
I’m straightforward about scope. Care plans cover technical work: updates, security, fixes, performance.