Why it feels random (it isn’t)
Missing WordPress emails feel random because the failure is invisible from the inside. WordPress hands the message to the server’s built-in mail function (wp_mail, which defaults to PHP’s mail()), the server says “sent,” and WordPress moves on. But the receiving inbox never trusts a message from an unauthenticated server, so it silently drops or spam-files it. The admin sees no error; the customer just never gets the email.
So the goal is not to “fix WordPress” — WordPress did its job. The goal is to send mail in a way modern inboxes will actually accept, which means authenticated SMTP and a properly configured sending domain.
The 15-minute fix
Move from broad guessing to a clean proof path. This is the order that fixes it fastest.
- Send a test email from the site to confirm the failure and see the current sender address.
- Check the “from” address — it must belong to a domain you control, not a generic or mismatched one.
- Install an SMTP plugin and connect a reputable transactional email provider.
- Add SPF, DKIM, and DMARC DNS records for your sending domain so inboxes can verify you (what these are).
- Re-test the exact form, order, password reset, or booking flow that actually failed.
Why SPF, DKIM, and DMARC matter
These three DNS records are how a receiving mail server checks that your email is really from you and not a forgery. Major providers increasingly require them — Google’s sender guidelines now expect authentication for reliable delivery. Without them, even SMTP-sent mail can land in spam. With them, your contact forms and order receipts actually arrive. This is the step DIY fixes most often skip.
Default WordPress mail vs authenticated SMTP
The difference is whether the receiving inbox trusts your message enough to deliver it.
| Aspect | Default (PHP mail) | SMTP + authenticated domain |
|---|---|---|
| How it sends | Server’s built-in mail function. | Authenticated connection to a mail provider. |
| Inbox trust | Low — often spam-filtered or dropped. | High — passes SPF/DKIM/DMARC checks. |
| Visibility of failures | Silent — no error shown. | Provider logs show delivery status. |
| Good enough for | Rarely anything business-critical. | Contact forms, orders, resets, bookings. |
Email-fix mistakes that waste an afternoon
- Using a “from” address on a domain you do not control, so authentication can never pass.
- Celebrating a generic test email that worked, while the real WooCommerce or form email still fails.
- Setting up SMTP but skipping SPF, DKIM, and DMARC, so mail still lands in spam.
- Blaming the form or store plugin when the real problem is server mail and domain authentication.
- Not re-testing the specific failing flow after making changes.
How we set up reliable WordPress email
In our experience, missing emails are one of the most common — and most damaging — silent failures, because a lost lead or order confirmation rarely throws an error; the business just quietly loses the contact. So on managed sites we route mail through authenticated SMTP with a verified domain as standard, and we test the real flows, since a generic “test email worked” proves almost nothing. It is a core part of the maintenance routine, especially for stores.
- Send through authenticated SMTP, never default server mail, for business-critical email.
- Set up SPF, DKIM, and DMARC on the sending domain.
- Test the actual flows — forms, orders, resets — not just a generic message.
- Monitor delivery so a future change does not silently break email again.
Frequently asked questions.
Why do WordPress emails go to spam?
Usually because the sending server is not trusted or the “from” domain is not authenticated. Sending through SMTP and adding SPF, DKIM, and DMARC records for your domain lets inboxes verify the mail is really from you, which is what keeps it out of spam.
Should WooCommerce order emails use SMTP?
Yes. Order confirmations and receipts are business-critical, so stores should use reliable authenticated transactional email, not default server mail. A missing receipt creates support load and erodes trust at the worst moment — right after someone has paid.
Do I need SPF, DKIM, and DMARC if I use SMTP?
Yes. SMTP gets the mail sent reliably, but SPF, DKIM, and DMARC are what let the receiving inbox verify and trust it. Major providers like Google increasingly expect authentication, so skipping these records can still leave mail in spam.
My contact form says “sent” but I never get the email — why?
The form plugin handed the message to WordPress successfully, but the server’s mail was distrusted and dropped downstream. That is exactly the default-mail problem this guide fixes: switch to authenticated SMTP and verify your sending domain.
Research sources.
This guide was checked against current platform and search documentation before publication.