Guides

WordPress

Why Your WordPress Emails Go to Spam (and How to Fix It)

Your contact form enquiries, WooCommerce order confirmations, password reset emails — they're probably ending up in spam folders, or not being delivered at all. And WordPress won't tell you. It'll just say "message sent." Here's what's actually happening, and how to fix it in plain English, no jargon required.

Published 26 June 2026 · Practical guide

The problem WordPress won't tell you about

Out of the box, WordPress uses PHP's built-in mail() function to send emails. On most modern web servers, this function relies on a local mail transfer agent (like Sendmail or Postfix) — and most hosting setups don't have one configured. The result? WordPress thinks the email was sent successfully (it returns true), but the message goes nowhere.

Even if your host does have a mail server configured, the email comes from an anonymous server IP with no domain authentication — no SPF, no DKIM, no DMARC. Gmail and Outlook see this and immediately flag it as spam, if they accept it at all.

This is why we see a pattern over and over with small business WordPress sites: the owner assumes their contact form works because there's no error. Meanwhile, weeks of enquiries, order receipts, and password resets have disappeared into the void.

Quick diagnostic: are your emails even being sent?

Before fixing anything, install the free WP Mail Logging plugin. It records every email WordPress tries to send, including the recipient, subject, and any error message:

  1. Go to Plugins → Add New → search "WP Mail Logging"
  2. Install and activate it
  3. Navigate to Tools → WP Mail Log

Send yourself a test email — from your contact form, or by triggering a password reset. Then check the log:

  • No entries at all: WordPress can't send email. Your server has no mailer configured.
  • Entry exists, error is blank: WordPress thought it sent the email. But it may still be in spam — that's a domain authentication issue.
  • Entry exists, error says something: The mailer rejected it. Could be wrong credentials, unverified sender, or a rate limit.

The three things email providers actually check

When Gmail or Outlook receives an email, they don't just read the "From" address and trust it. They run three checks — and if any of them fail, your email goes to spam:

SPF (Sender Policy Framework)

SPF tells the world: "These are the only servers authorised to send email from my domain." It's a simple line of text in your DNS records. Without it, anyone can send email pretending to be you — and email providers know this, so they treat unauthenticated email as suspicious.

Example SPF record: v=spf1 include:spf.protection.outlook.com -all

This says: only Microsoft 365 servers can send email for this domain. Everything else should be rejected.

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to every email you send. The receiving server checks this signature against a public key published in your DNS. If they match, the email hasn't been tampered with. Think of it as a wax seal on a letter — it proves you wrote it and nobody changed it in transit.

DKIM is usually set up automatically when you use a proper email provider like Microsoft 365 or Google Workspace. If you're using a third-party SMTP service like Brevo, you'll need to add the DKIM records they provide.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together. It tells email providers: "Here's what to do if an email from my domain fails the SPF or DKIM check." You can set it to none (just monitor), quarantine (send to spam), or reject (block entirely).

Example DMARC record: v=DMARC1; p=quarantine; rua=mailto:[email protected]

The rua address gets reports showing who's trying to send email as your domain. This is how you catch spammers impersonating your business.

Four ways to fix it — from easiest to most professional

Option 1: Gmail SMTP (simplest, free, 10 minutes)

If you already use Gmail, this is the quickest fix. You'll need a Gmail App Password — not your regular Gmail password:

  1. Go to myaccount.google.com/apppasswords
  2. Sign in, select "Mail" and your device, click Generate
  3. Copy the 16-character password
  4. In WordPress, install the WP Mail SMTP plugin
  5. Set From Email to your Gmail address, From Name to your business name
  6. Under Mailer, select "Other SMTP"
  7. Configure: Host = smtp.gmail.com, Port = 587, Encryption = TLS, Authentication = On
  8. Username = your Gmail address, Password = the 16-character App Password
  9. Save and send a test email

Limitation: Gmail has a sending limit of about 500 emails per day. It's fine for a small business contact form, but not for a busy WooCommerce store sending hundreds of order confirmations. Also, the emails come from your Gmail address — not [email protected] — which looks less professional.

Option 2: Microsoft 365 SMTP (for businesses that already have Microsoft 365)

If your business email is through Microsoft 365 (Outlook), you can use the same account to send WordPress emails. The setup is similar to Gmail:

  1. An M365 admin needs to enable "Authenticated SMTP" on the mailbox — go to admin.microsoft.com → Users → select the user → Mail → Email apps → tick "Authenticated SMTP"
  2. If your organisation uses Security Defaults (most do), you'll need to create an App Password at mysignins.microsoft.com/security-info
  3. In WP Mail SMTP: Host = smtp.office365.com, Port = 587, Encryption = TLS, Username = [email protected]

Common pitfall: If you don't see "App passwords" at the bottom of the security-info page, Security Defaults is blocking them. Don't turn off Security Defaults — use Option 3 instead.

Option 3: FluentSMTP + Microsoft 365 OAuth (recommended — secure, no passwords)

This is the setup we use for clients and on our own sites. Instead of storing an App Password in WordPress (which is a security risk), FluentSMTP connects to Microsoft 365 using OAuth — the same secure "Sign in with Microsoft" flow used by thousands of apps.

What makes this better:

  • No passwords stored in WordPress — if your site gets compromised, there's nothing for an attacker to steal
  • Emails come from your actual domain ([email protected]), not a Gmail address relayed through a third party
  • Works even when Microsoft Security Defaults blocks traditional SMTP
  • Free — no Brevo, SendGrid, or Mailgun subscription needed

(If you'd rather we handle the setup, get in touch — it takes about 30 minutes of clicking through the Azure portal, and we can do it remotely.)

Option 4: Brevo / Sendinblue (API-based, good free tier)

Brevo (formerly Sendinblue) offers 300 free emails per day through their API. It's a good option if you can't use Gmail or Microsoft 365:

  1. Create a free account at brevo.com
  2. Get your API key from Account → SMTP & API → API Keys
  3. In WP Mail SMTP, select "Sendinblue" as the mailer and paste your API key
  4. Critical step: Go to Brevo dashboard → Senders → add and verify your sending email address. Without this, emails silently fail with no error.
  5. Also add your domain under Domains → Add domain and set up the DKIM records they provide

Pitfall: If you skip the sender verification, Brevo accepts your API call but doesn't deliver the email. The log will show error=NULL and you'll assume everything is fine. Always verify your sender in the Brevo dashboard.

Testing: how to know it actually worked

After configuring any of these options, test with a real email address — but not a Gmail address. Gmail's spam filter is unusually aggressive with transactional emails, especially during testing. Use an Outlook, Yahoo, or iCloud address for your first test.

The WP Mail SMTP plugin has a built-in "Email Test" feature. Send a test email to your non-Gmail address and check:

  • Does it arrive in your inbox (not spam)?
  • Does the "From" name and email look correct?
  • Is the content formatting intact?

If it goes to spam, check your SPF and DKIM records — they're the most common cause. There are free tools like MXToolbox SPF Checker and Mail Tester that'll tell you exactly what's wrong.

Why we prefer FluentSMTP + Microsoft 365

After setting up email delivery for dozens of small business WordPress sites, we've settled on FluentSMTP with Microsoft 365 OAuth as the default recommendation. Here's why:

  • Security: No passwords, no API keys stored in WordPress. If your site gets hacked, your email account isn't compromised.
  • Professionalism: Emails come from your actual business domain, not a Gmail address or a third-party relay like "sent-via-sendinblue.net."
  • Deliverability: Microsoft's infrastructure has excellent reputation with spam filters. Emails from M365 are rarely flagged.
  • Free tier: The Azure app registration is free. You don't need any paid add-ons.
  • No daily limit anxiety: Unlike Brevo's 300/day or Gmail's 500/day, M365 limits are generous enough for any small business — even busy WooCommerce stores.

Gmail SMTP is a perfectly fine starting point for a simple contact form. Brevo works well if you're not on Microsoft 365. But if your business already pays for M365 email — and most small businesses in the UK do — FluentSMTP OAuth is the setup that'll keep working reliably for years with zero maintenance.

One more thing: check your WooCommerce "From" address

If you run WooCommerce, it has its own "from" email settings that override whatever you configure in your SMTP plugin. Even after setting up FluentSMTP correctly, your order emails might still show the wrong sender name or address. Fix this at:

  • WooCommerce → Settings → Emails → "From" name and "From" address
  • Or via WP-CLI: wp option update woocommerce_email_from_address "[email protected]"

Also check that no other SMTP plugins are active. Having WP Mail SMTP and Post SMTP and Easy WP SMTP all installed at once — which happens surprisingly often — creates conflicts where none of them work correctly. Go to Plugins → Installed Plugins and deactivate everything except your chosen mailer.

Need help?

If you've followed this guide and your emails are still going to spam — or if you'd rather someone else handle the DNS records and Azure portal — get in touch. We do this for small businesses across Nottingham, Derby, and the East Midlands. Most setups are done in under an hour, and we'll test with your actual domain before we call it done.