WordPress e-mails not arriving: SMTP, SPF, DKIM and DMARC setup

A contact form submission never shows up, a customer does not receive their WooCommerce order confirmation, and the password reset e-mail vanishes somewhere along the way. The fault is rarely in the form or the shop. It is in how WordPress sends mail: by default it uses the web server’s PHP mail() function, with no authentication and often with a sender address that does not belong to your domain. Gmail, Outlook and other providers treat such mail as suspicious and either file it under spam or drop it silently.

When the work is done, your site sends through authenticated SMTP or a transactional e-mail service, your domain has correct SPF, DKIM and DMARC records, and every outgoing message is logged inside WordPress. A failure is visible immediately, not a week later when a customer complains.

What the work includes

• Diagnosis. We check how mail currently leaves the site: whether it goes out via PHP mail() straight from the web server, with which sender address and from which domain. We review the existing DNS records and message headers to find the actual cause rather than the symptom.
• Choosing the sending route. Together we decide between your hosting provider’s SMTP server and a transactional service (Brevo, Postmark, SendGrid or Mailgun). The choice depends on volume, whether you want delivery statistics, and whether the same domain already sends mail from elsewhere.
• SMTP configuration in WordPress. We route wp_mail() through an authenticated connection, set the sender name and address, and store the credentials securely rather than in plain text in the database.
• SPF, DKIM and DMARC records. We add or correct the DNS records so the new sender is authorised and existing senders (for example Microsoft 365, Google Workspace or your newsletter tool) are not left out. DMARC starts in monitoring mode and is tightened once the reports are clean.
• A consistent sender domain. Mail goes out from your own domain, not from the server hostname or a Gmail address, and Reply-To is set so that replies reach the right person.
• Mail logging. We install an e-mail log in WordPress that shows the time, recipient and content of every message, and the reason when one fails.
• Testing. We submit real contact forms, place a test order and trigger a password reset, then verify delivery to Gmail, Outlook and the local providers your customers use.
• Spam-score check. We review headers, SPF, DKIM and DMARC results and the message content from a spam filter’s point of view, and fix what we find.

Typical situations

Contact form notifications arrived for years, then stopped after a server migration or PHP upgrade because the new server’s IP has no reputation and is missing from the SPF record. A WooCommerce shop sends order confirmations that land in Gmail’s spam folder because the sender is your info@ address but the domain has no DKIM signature. A form uses the visitor’s own e-mail address as the sender, which their provider’s DMARC policy rejects. Or the hosting provider has started restricting mail() and nothing goes out at all, but nobody knows because WordPress shows no error.

What we need from you

• WordPress administrator access and, where possible, access to the hosting control panel.
• Access to the domain’s DNS management, or a contact who will add the records from our instructions.
• A list of services that already send mail from your domain: business e-mail, newsletter tool, accounting software.
• A decision between the hosting provider’s SMTP and a transactional service, and for the latter an account created in your name.
• A few test mailboxes at different providers that we can send trial messages to.

What is not included

• Newsletter and marketing list setup; that is a separate newsletter solution service.
• Migrating or configuring business e-mail (Google Workspace, Microsoft 365), although we account for their SPF and DKIM requirements.
• Rewriting or redesigning the e-mails themselves; customising WooCommerce e-mail templates is estimated separately.
• Changing server or hosting; if the root cause is a blacklisted hosting IP, we recommend a hosting review.
• The monthly fee of a transactional service, which is between you and the provider.

Who it suits

Any WordPress site or WooCommerce shop where e-mails go missing or end up in spam and nobody knows exactly why. If mail has stopped along with everything else because the site is down or hacked, start with emergency help instead. If you want a full picture of the site’s condition first, the health and security audit is the right place; for sites on our monthly maintenance we keep sending in order as part of the service.