WordPress's wp_mail() looks simple until it silently stops working. Contact Form 7 submissions land in a black hole. WooCommerce order emails never reach the customer. Password resets never arrive. Here's exactly why it breaks and the six-step fix that actually holds.

What wp_mail() actually does

Under the hood, wp_mail() hands mail to PHP's mail() function, which calls the server's local sendmail. That message goes out with:

A From address that doesn't match your domain (usually [email protected]).
No SPF alignment (your host isn't authorized to send as your domain).
No DKIM signature (nothing proves the message wasn't altered).

Gmail sees a message from [email protected] coming from a random hosting server with no auth. It goes to spam or gets rejected outright.

The six-step fix

1. Confirm the problem is delivery, not sending

Install a plugin like WP Mail Logging (or use our SecureSMTP plugin's built-in log) and check whether wp_mail() is actually being called. If it's not, you have a broken plugin. If it is, delivery is the problem.

2. Stop using the server's local mail

Install an SMTP plugin so wp_mail() hands mail to an authenticated relay instead of local sendmail. SecureSMTP, WP Mail SMTP, and Post SMTP all do this.

3. Set the From address to your domain

Configure the plugin's From address to [email protected] (not[email protected]). This is what SPF and DKIM will validate against.

4. Add SPF to your DNS

A TXT record at your domain root:

v=spf1 include:_spf.securessmtp.com ~all

Replace _spf.securessmtp.com with whatever your relay provider tells you.

5. Add DKIM to your DNS

Your relay generates a TXT record like securessmtp._domainkey.yourbrand.com — paste it into your DNS. Once propagated, every wp_mail() send is cryptographically signed.

6. Add DMARC and monitor

Start with p=none to just observe:

v=DMARC1; p=none; rua=mailto:[email protected]

Wait a week. Read the aggregate reports. If SPF and DKIM are aligned across your sends, upgrade to p=quarantine, then p=reject.

Why the fix holds

With a proper SMTP relay + SPF + DKIM aligned, Gmail sees a message from your domain, authenticated by your DNS records, signed by your relay. It's the same authentication posture Fortune 500 senders use. Deliverability isn't magic — it's just DNS + an authenticated sender.

If you want the SMTP plugin done in one click, SecureSMTP for WordPress does all six steps above with a wizard.

Why wp_mail() stops working (and the 6-step fix that actually holds)