Your contact form says the message was sent. You check your inbox an hour later and find nothing. Then the customer messages you on social media: “I emailed you three days ago.” Meanwhile your order confirmations, password resets, and booking reminders are quietly landing in customers’ junk folders. Nobody tells you. There is no error message, no bounce, no warning.
That silence is the real problem. WordPress reports every email as sent because it handed the message to your server. What happens after that, the part where Gmail decides whether to trust it, is where things break.
The fix is almost always the same: your WordPress site is sending email in a way inbox providers do not trust. This guide shows you how to confirm that in about a minute, then fix it in order, from the free ten-minute version to the permanent setup that stops the problem for good.
Why WordPress Emails Land in Spam
Out of the box, WordPress sends email using PHP’s mail() function. Your web server hands the message to whatever mail system your hosting account provides, and it goes out from the server’s IP address. There is no signature proving the message really came from your domain.
Gmail, Outlook, and Yahoo do not take that on trust. When a message arrives with no SPF, DKIM, or DMARC authentication, they cannot verify the sender, so they treat it as suspicious and route it to spam. Your message is not blocked. It is simply not trusted.
Three things make it worse:
- Shared hosting IPs. On cheap shared hosting, hundreds of sites send from the same IP. If a few of them are sending spam, the reputation of that IP suffers, and so does yours.
- A mismatched From address. Many forms are configured to send “from” the visitor’s own email address, or from wordpress@yourdomain.com with no real mailbox behind it. Both fail authentication checks.
- No domain mailbox at all. If your domain has no real email account, every message your site sends looks like it came from a stranger.
The result is inconsistent delivery: some messages arrive, some vanish, and the pattern never makes sense until you actually look at the mail headers.
Confirm It in 60 Seconds (Do This First)
Before you change a single setting, prove what is actually happening. This takes one test message:
- Send a test email through your form to a Gmail address you own. Use your live contact form, not a plugin preview.
- Open the message and click the three dots, then “Show original.” Look for three lines: SPF, DKIM, and DMARC. Each should say PASS. Any FAIL explains your problem immediately.
- Check the sending server. In the same header view, find “Return-Path” and the first “Received” line. If the sending server belongs to your host and not your domain, your mail is going out unauthenticated from a shared IP.
- Run the same message through mail-tester.com. It is free, and it returns a score out of 10 with a plain list of what is broken.
- Check your DNS records for SPF (a TXT record starting with v=spf1), DKIM (a selector like default._domainkey), and DMARC (a TXT record at _dmarc). Your host’s DNS panel or MXToolbox shows these. Missing records confirm the cause.
- Open your form’s notification settings and read the From address. If it is the visitor’s email or a Gmail address, that is a fix you can make right now.
If SPF, DKIM, and DMARC all show PASS and your mail still lands in spam, the cause is usually content or a blocklisted IP. If any of them FAIL, the levels below are your fix, in order.
Level 1: The 10-Minute Fix (From Address)
Start here because it is free and it fixes the single most common mistake. Open your form plugin (WPForms, Gravity Forms, Contact Form 7, or whatever you use), find the notification settings, and change the From address to a real mailbox on your own domain. Something like hello@yoursite.com. (If your form produces no email at all rather than filtered email, that is a different problem, covered in our guide to WordPress forms not working or emails not sending.)
- Never use the visitor’s email address as the From address. It looks like spoofing and fails DMARC.
- Do not send from a Gmail or Outlook address while your site sends on behalf of your domain.
- Create the mailbox first. If hello@yoursite.com does not exist, replies bounce and providers lose trust.
- Keep “Reply-To” set to the visitor’s address so you can still hit reply.
Expected result: more consistent delivery, but not a complete fix on its own. If your site still sends through your host’s unauthenticated server, some providers will keep filtering it. That is what the next level solves.
Level 2: Authenticate Your Domain (SPF, DKIM, DMARC)
Authentication is the difference between “we think this is from you” and “we can prove it is from you.” Three DNS records do that work:
- SPF lists the servers allowed to send email for your domain.
- DKIM adds a cryptographic signature proving the message was not altered in transit.
- DMARC tells providers what to do when the first two fail, and sends you reports.
You add all three as DNS records in your domain’s control panel. Where to get the exact values:
- If you use Google Workspace or Microsoft 365, both generate the records for you inside their admin consoles.
- If you use your host’s email, your host’s documentation lists the values to copy.
- Stuck? Your host’s support team can usually paste the exact records you need.
Then send another test. You want SPF, DKIM, and DMARC all showing PASS in the Gmail header. This step is free, permanent, and it is the single biggest jump in deliverability you can make. One tip: set your DMARC policy to p=none first and watch the reports before you tighten it, so you do not accidentally block legitimate mail.
Level 3: Send Through a Real Email Service (The Permanent Fix)
Authentication proves your mail is genuine, but it does not fix a poor shared IP reputation or a host that mangles messages. The permanent fix is to stop letting your web server send email at all, and route it through a service built for deliverability.
The setup has two parts:
- A free SMTP plugin such as WP Mail SMTP, FluentSMTP, or Post SMTP. This connects WordPress to an external sender instead of PHP mail().
- A sending service with authentication handled and warmed sending infrastructure.
For most small sites, MailerLite is the easiest place to land. The free plan covers up to 250 subscribers and 2,500 emails a month, which is plenty for contact forms, order confirmations, and a small newsletter. Paid plans start at $12 per month on the Comfort plan, which adds automations, unlimited templates, a subscriber preference center, and ten times the sending ceiling. If your site sends mostly transactional messages, form notifications, receipts, and password resets, MailerSend is the transactional sibling, with a free tier of 500 emails a month and the Hobby plan at $7 per month for 5,000 emails.
The important thing is not the brand name. It is that email leaves your site through authenticated infrastructure with a reputation you can actually control and monitor.
Send email that actually lands
Expected result: messages arrive in the inbox, and you get delivery and open data instead of silence. Still weighing tools? Our WordPress email marketing plugin comparison breaks down how the main options differ.
Level 4: Pro Habits That Keep You Out of Spam
Once delivery is working, a few habits keep it that way:
- Warm up a new domain. Do not send 5,000 emails from a brand new domain on day one. Start small and grow.
- Practice list hygiene. Remove hard bounces, and stop mailing people who have not opened anything in months. Unengaged addresses get you filtered.
- Watch your content. All-caps subject lines, excessive links, and image-only emails with no real text are classic spam signals.
- Stay consistent. Send from the same From name and address every time, so providers build a stable reputation for you.
- Monitor. Re-check mail-tester after setup, watch your DMARC reports, and use Google Postmaster Tools if you send at any volume.
Quick Comparison of the Fix Options
| Option | Best For | Starting Price | Rating | Get Started |
|---|---|---|---|---|
| MailerLite | Newsletters, automations, and a small list | Free up to 250 subscribers, then $12/month | 4.8/5 | Get started |
| MailerSend | Form notifications, receipts, password resets | Free up to 500 emails/month, then $7/month | 4.6/5 | Get started |
When It’s Worth Paying
The free fixes, correcting your From address and adding authentication, genuinely solve deliverability for plenty of small sites. Pay for a sending service once you send regularly and need delivery you do not have to babysit: order confirmations that must arrive, password resets people depend on, or a newsletter that earns revenue. At $12 a month for MailerLite or $7 for MailerSend, the maths is simple. If one customer email or one recovery sequence lands in the inbox instead of spam, it has already paid for itself.
There is one more layer worth checking, and it is the one most people ignore: your hosting. If you are on cheap shared hosting, your server’s IP address is shared with hundreds of other sites, and a handful of them are sending spam. That reputation drags your domain down no matter how good your authentication is. Moving to a host that isolates your resources removes that variable entirely.
If your hosting is the bottleneck: Kinsta keeps your site safe with automatic daily backups and one-click restore, so a bad update or a hack is a rollback, not a rebuild. Their support is top tier, and 24/7 live chat is staffed by WordPress engineers who will help fix the actual problem with you, so you are not stuck waiting on your developer to reply. Plans start at $35 per month.
FAQ
Because “sent” only means WordPress passed the message to your server. Delivery depends on whether the receiving provider trusts it. If your site sends through PHP mail() with no SPF, DKIM, or DMARC authentication, Gmail and Outlook cannot verify the sender and filter it to spam by default.
For most self-hosted WordPress sites, yes, authentication is the biggest single fix. It proves your messages are genuine, but it does not repair a poor shared IP reputation. If you are on shared hosting and still filtered after authenticating, routing mail through a dedicated email service is the next step.
A free SMTP plugin only handles the connection, not the sending reputation. Many hosts offer a mailbox you can relay through, which is a fine free starting point. Once you send regularly, a service like MailerLite or MailerSend adds authenticated infrastructure, delivery data, and a warm sending reputation for a few dollars a month.
Send a test through your contact form to a Gmail address, open the message, click the three dots, and choose “Show original.” Check that SPF, DKIM, and DMARC all show PASS. You can also run the same message through mail-tester.com for a score out of ten with a list of specific problems.
Yes. On shared hosting your server IP is used by many websites, and if some of them send spam, the whole IP loses reputation. Inbox providers then treat your legitimate mail with suspicion. Hosting that isolates your site and provides proper sending tools removes that risk.
Final Thoughts: Do This First
You do not need to overhaul everything at once. Do these three things today, in order:
- Send one test through your form to a Gmail address, and check the SPF, DKIM, and DMARC lines in “Show original.”
- Fix the From address in your form plugin so it uses a real mailbox on your own domain.
- Add the SPF, DKIM, and DMARC records your email provider gives you, then test again.
That sequence fixes the majority of spam-folder problems for free. If mail still lands in spam after all three, move your sending to a dedicated email service, and if you are on shared hosting, move the site itself. Once delivery is reliable, the next win is turning those delivered emails into a list you actually own. Start with our guide to building an email list with WordPress.
This post contains affiliate links. If you buy through them, I may earn a small commission at no extra cost to you.
About The Author
