WPForms Gmail integration: send WPForms emails through Gmail or Google Workspace (and when not to)

WPForms has no Gmail setting of its own. It builds each notification and hands it to WordPress, so to send WPForms emails through a Gmail or Google Workspace account you connect an SMTP plugin, such as WP Mail SMTP, to that Google account. You connect it with a Google sign-in (OAuth) or with an app password. It works for a small site, but Google caps how much one account can send, and the connection can break when the account’s password or security settings change.

If your real problem is that WPForms notifications do not arrive in a Gmail inbox, go straight to notifications that do not reach a Gmail inbox.

Sending through Gmail vs receiving in Gmail

• Sending through Gmail. Your site signs in to a Gmail or Google Workspace account and sends the notification as that account. Most of this article is about this.
• Receiving in Gmail. Your site sends the notification the normal way, to an address at Gmail, and Gmail puts it in Spam or does not show it. The section “Notifications that do not reach a Gmail inbox” covers this.

The fixes are different, so decide which one you have before you change anything.

How WPForms sends email

Open a form and go to Settings → Notifications. Each notification has Send To Email Address, Email Subject Line, From Name, From Email, Reply-To Email Address and Email Message. When someone submits the form, WPForms builds the email from those fields and passes it to WordPress’s wp_mail() function.

Without a mail plugin, WordPress then uses your web server’s own mail function. There is no login to any mail account, and the email is usually not DKIM-signed for your domain, which Gmail looks for. That is the usual cause of the problems described in how to fix WordPress not sending email.

Connecting Gmail replaces only that last step. The plugin signs in to your Google account and Google’s servers send the email. WPForms is not involved in the connection.

Pick a connection method

The steps below use WP Mail SMTP, because WPForms’ own documentation points to it. Any SMTP plugin with the same options works the same way.

Method 1: Google sign-in (OAuth)

1. Install and activate WP Mail SMTP. Open WP Mail SMTP → Settings, stay on the General tab, and under Mailer choose Google / Gmail.
2. With the Pro version: switch on One-Click Setup and click Save Settings. In the Authorization section click Sign in with Google, choose the account and click Allow. This needs WP Mail SMTP 3.11.0 or later and a site on HTTPS.
3. With the free version: create a Google Cloud project, enable the Gmail API under APIs & Services → Library, set up the OAuth consent screen, and create an OAuth client of type Web application. Add https://connect.wpmailsmtp.com/google/ as an authorized redirect URI. Paste the Client ID and Client Secret into the plugin, click Save Settings, then click Allow plugin to send emails using your Google account.
4. Publish the Google app. On a personal Gmail account click Publish App and confirm. On Google Workspace set the consent screen’s user type to External and the status to production; otherwise people outside your organization can get Error 403: org_internal.
5. Set the sender address as described in the next section, then send a test (see “Confirm it works”).

Do not skip step 4. Google says refresh tokens for an app in Testing status expire after 7 days, which is why a freshly connected site works for a week and then stops with a Google token error. The matching fixes are in WP Mail SMTP not working: common errors.

Method 2: SMTP with an app password

1. Turn on 2-Step Verification for the Google account. An app password cannot be created without it.
2. Go to myaccount.google.com/apppasswords, create an app password and copy it. If the page does not let you, you are probably on a work account where the administrator has not allowed them.
3. In WP Mail SMTP choose the Other SMTP mailer and enter:

   SMTP Host:       smtp.gmail.com
   Encryption:      TLS      (or SSL with port 465)
   SMTP Port:       587      (or 465 with SSL)
   Authentication:  On
   SMTP Username:   your full Gmail or Workspace address
   SMTP Password:   the app password

4. Save, then send a test.

Two warnings from Google’s help pages. App passwords are not recommended and are unnecessary in most cases when an app can use “Sign in with Google”. And Google revokes your app passwords when you change the account password, so email from the site stops until you create a new one. WP Mail SMTP’s own documentation also suggests its Google / Gmail mailer over Other SMTP for Gmail.

Method 3: Google Workspace SMTP relay

This is for Workspace administrators. In the Admin console go to Menu → Apps → Google Workspace → Gmail → Routing and add the SMTP relay service setting. You choose who may send (for example, only addresses in your domains) and how the relay recognizes your site: by its IP address, by SMTP authentication, or both. Your site then connects to smtp-relay.gmail.com on port 587 with TLS, which Google recommends.

The catch for WordPress is the IP address. Google’s page for apps and devices says authentication might need a static IP address. On shared hosting your outgoing IP is shared with other sites and can change. Check with your host before choosing this. The relay has its own limits, listed on Google’s SMTP relay page.

Set the From address correctly

In the WPForms notification, set From Email to the Gmail or Workspace address you connected, or to an alias of it. Set Reply-To Email Address to the form’s Email field with the smart tag, so pressing Reply writes back to the visitor. The reason is explained in why a form must not send from the visitor’s email.

The From Email has to match the account because Gmail only lets an account send as itself or as an address in its Send mail as list. When a site connects to Gmail’s SMTP server and uses any other From address, Gmail replaces it with the account’s address. You then see your Gmail address on every notification and wonder why WPForms ignored your setting.

To send from another address, such as [email protected], add it in Gmail under Settings → See all settings → Accounts and import → Send mail as → Add another email address and confirm the verification email. This route works when the address is an alias on your Google Workspace account. WP Mail SMTP then lists the account’s aliases in its From Email dropdown. If you turn on its Force From Email option, the From Email field in WPForms is disabled and every form uses the plugin’s address.

Gmail’s sending limits

Google sets a daily limit per account. At the time of writing, its help pages say:

• Personal Gmail: sending more than 500 emails in a day, or one email to more than 500 recipients, triggers a limit.
• Google Workspace: 2,000 messages a day per user account (1,500 for mail merge and 500 for trial accounts), counted over a rolling 24-hour period.

When the limit is reached, Google shows an error and the account cannot send for up to 24 hours. It can still receive. Google also says limits can change without notice, so check the Gmail sending limits in Google Workspace help page before you rely on a number.

The limit belongs to the account, not to your site. Everything else that account sends counts too. A form that sends one notification to you and one auto-reply to the visitor uses two emails per submission.

Why the notifications still land in spam

• The From address says Gmail but Gmail did not send it. If the From Email is an @gmail.com address and the email actually leaves your web server, it is a forgery as far as Gmail can tell. Google’s sender guidelines say not to impersonate Gmail From: headers. Either send through Google for real, or use an address on your own domain.
• Your own domain, but SPF and DKIM are not set for Google. On Workspace, the SPF record for Google is v=spf1 include:_spf.google.com ~all. DKIM is switched on under Menu → Apps → Google Workspace → Gmail → Authenticate email: generate the record, add it to your DNS, then click Start authentication. Google says DKIM can take up to 48 hours to start working. See SPF vs DKIM vs DMARC.

Downsides of using Gmail for a business site

• It is tied to one mailbox. If that person leaves or changes their password, form email can stop. Changing the Google password revokes app passwords, and Google says it also stops OAuth refresh tokens that include Gmail scopes. Turning on 2-Step Verification after setup means authorizing again.
• Every notification fills the Sent folder of that mailbox, and anyone with access to the mailbox can read what visitors typed into your forms.
• There is no delivery log for the site. If a notification to a customer bounces, you learn about it from a Mail Delivery Subsystem message in that mailbox, if someone looks.
• A credential that can send as you is kept on the website. If the site is compromised, whoever has access can send email in your name.

Gmail or Workspace is a fair choice when the site gets a few submissions a day, the From address is on your own domain, and someone will notice if the connection breaks. It is a poor choice for a shop, for several sites sharing one account, or when you need to prove that an email was delivered.

Send from your own domain through a sending service

The alternative is to keep Gmail or Workspace for your own inbox and use a separate transactional email service for what the website sends. You add DNS records for your domain (DKIM, and SPF only if the service asks for it) once, then WPForms sends from an address such as [email protected], signed for your domain, and not through anyone’s personal mailbox. There is no Google Cloud app to publish, no app password to expire and no shared daily limit with your staff email.

SecureSMTP does this for WPForms. Its WordPress plugin connects in a few minutes and routes wp_mail(), and with it every WPForms notification, through SecureSMTP. Mail is sent from your own domain with DKIM signing. Every email appears in the email log with its status, such as delivered or bounced, and bounces and complaints go on a suppression list. The free plan allows 5,000 emails a month for 1 site and 1 sending domain, and paid plans start at $7 a month. New accounts verify their domain by adding DNS records; until then they can send up to 10 test emails a day to their own address. Setup is in the WordPress plugin guide.

If a sending service tells you to add an SPF include, merge it into your single SPF record, because a domain should have only one. SecureSMTP does not need a change to your main SPF record; see Domains and DNS.

Notifications that do not reach a Gmail inbox

If your notifications go to a Gmail address and do not show up, go through these in order. The longer version is contact form emails not reaching Gmail or Google Workspace.

1. In Gmail’s search box type in:anywhere and a word from the subject. Normal searches skip Spam and Trash. Also look at Settings → Filters and Blocked Addresses.
2. In the WPForms notification, check that From Email is on your site’s domain, not gmail.com, and differs from Send To Email Address (see the warning above). WPForms shows “The current From Email does not match your website domain name” when the domain differs.
3. If the email is in Spam, open it and choose ⋮ → Show original. Gmail lists SPF, DKIM and DMARC as PASS or FAIL. Google requires SPF or DKIM from every sender, so a missing DKIM signature is enough to hurt delivery.
4. Stop sending through the web server’s mail function. Use an authenticated service with your domain’s SPF and DKIM set up, whether that is your own Workspace account or a sending service.

Confirm it works

In WP Mail SMTP open Tools → Email Test, enter an address you can check and click Send Email. Then submit the real form. Three things to check:

• The email arrives in the inbox, not Spam.
• The sender shown is the address you chose. If it shows the Gmail account instead, the From address is probably not in the account’s Send mail as list.
• Show original lists SPF and DKIM as PASS (and DMARC, if your domain has a record).

On the Gmail route, the sent message also appears in the account’s Sent folder. With SecureSMTP you see it in the email log with its delivery status instead.

Frequently asked questions