Fix WordPress wp_mail() going to spam: the complete diagnostic + fix guide

Your WordPress site looks great. Your contact form looks great. A visitor submits it, the form says “Thanks, we’ll be in touch!” — and the notification email never arrives in your inbox. Or it arrives in spam. Or it arrives three hours late, after the lead has already moved on.

You’re not unlucky. WordPress email is broken by default — and most fixes only solve half of the problem. Here’s why, and how to fix it for good.

Why wp_mail() emails go to spam

WordPress’s built-in wp_mail() function is a thin wrapper around PHP’s mail() function. By default, when your site sends an email, three things happen that almost guarantee delivery problems:

1. The “From” address fails SPF

Out of the box, WordPress sends from [email protected] (where yourhost.com is your hosting provider’s server hostname — not your real domain). When Gmail or Outlook receive this message, they check whether your hosting provider is authorized to send mail for that domain. It usually isn’t. SPF check fails. Message goes to spam.

2. There’s no DKIM signature

Modern mail servers expect every legitimate email to be cryptographically signed with DKIM. PHP’s default mail() function doesn’t sign anything. Even if SPF passes, the lack of DKIM signature is a strong spam signal to Gmail and Outlook.

3. DMARC alignment is impossible

Even if you manually set the From address to your real domain, the underlying sending IP is your shared hosting server — which has zero relationship with your domain. DMARC checks fail. Gmail silently drops the message.

Diagnose your WordPress delivery problem

Run these four checks in order:

1. Submit your contact form, password reset, or test order

Use a Gmail address you control. Wait 5 minutes. Check inbox AND spam folder. If it’s in spam, you have an SPF/DKIM/DMARC problem. If it’s missing entirely, you have a delivery problem.

2. Check your site’s mail log

Most WordPress sites don’t log outbound mail by default. If you have any SMTP / mail plugin installed (WP Mail SMTP, FluentSMTP, SecureSMTP), check its log for the recent send. Status should be “Delivered.” If status is “Failed,” the message never left your server.

3. Run a mail-tester.com diagnostic

Go to mail-tester.com (free, no signup). Send a test message from your WordPress site to the address they give you. Read the report. A score below 7/10 explains the problem.

4. Check the “From” address being used

Send yourself a test email and inspect the headers. Look for theFrom: line. If it says [email protected] instead of your real domain, that’s your problem in one line.

Three ways to fix WordPress email

Option 1: Configure SPF + DKIM manually (free, complex)

You can configure your hosting provider’s mail server to send from your real domain with proper SPF/DKIM/DMARC. This usually requires support tickets to your host, DNS record changes, and constant babysitting when records expire or get reset.

Pros: Free.
Cons: Most shared hosts don’t let you do this. Even on managed hosts, you’ll spend 4–8 hours setting it up and another 1–2 hours per month maintaining it. And it only fixes one site.

Option 2: Install an SMTP plugin + sign up for a mail service

Install WP Mail SMTP or FluentSMTP, then sign up for SendGrid / Mailgun / Brevo / SES, configure DKIM on the mail service side, paste credentials into the SMTP plugin, watch for quota errors and reputation problems.

Pros: Works reasonably well.
Cons: Two services to manage (the SMTP plugin and the mail provider). DKIM setup is non-trivial. Each provider has different quota tiers, billing, and dashboards. Total setup time: 2–4 hours for someone who’s done it before; a full afternoon for first-timers.

Option 3: Install the SecureSMTP plugin (recommended)

One plugin. One signup. Done. SecureSMTP combines the SMTP routing layer and the authenticated mail service in a single workflow — no third-party SMTP provider to configure, and only one DNS record to add for your sending domain.

Recommended: SecureSMTP plugin setup

1. Sign up free at securessmtp.com/signup — 5,000 emails/month included, no card required.
2. Dashboard → Forms → Sites → + Add Site. Copy the site’s API key from the last step. It is shown only once.
3. WordPress Admin → Plugins → Add New Plugin → Upload Plugin → upload the SecureSMTP plugin .zip → Install Now → Activate.
4. In wp-admin open SecureSMTP → Settings, paste the key into API Key and click Save and test connection. You should see “Connection OK”.
5. Under Email Delivery, tick Route outgoing email through SecureSMTP and save. Until you tick it, WordPress keeps sending with its own mailer.
6. Click Save and send test email to send yourself a test.

From then on, every email your site sends with wp_mail() (contact form notifications, password resets, WooCommerce order emails, comment notifications) goes through SecureSMTP and is signed with DKIM. New accounts send from their own verified sending domain (below). Older accounts can keep using [email protected] for a limited time, with your sender name, and the original From address becomes the Reply-To.

Verify it’s working

1. Run mail-tester.com again. Score should jump to 9+/10.
2. Send yourself a test order or form submission. It should arrive in the inbox within a minute.
3. Check the plugin Mail Log. The email is listed with status Sent. The Email log in your SecureSMTP dashboard shows whether it was delivered, and opens if tracking is on.
4. Check Gmail’s “Show original” on the test email. DKIM should pass. DMARC passes for your own domain once you send from a verified sending domain.

wp_mail() vs SMTP plugins vs SecureSMTP

Frequently asked questions