Emails from your website or WordPress go to spam

What it means

By default, WordPress and many websites send email with the web server's own built-in mail function (PHP mail()). The email leaves from your hosting server, usually without DKIM, often with an SPF that does not include that server, and sometimes with a From address that is not even yours.

Receivers see an email claiming to come from your domain but sent by an unknown server, so they send it to spam or refuse it.

Why it matters

• Customers do not receive order confirmations, invoices or password resets.
• You miss messages from your contact form.
• A shared hosting server's IP may be blacklisted because of other websites on it.

How to check

• Send a test email from your website: on the home page, copy your unique test address, then use it in your website's contact form, password reset or a test order. Open the report: look at SPF, DKIM, DMARC, blacklists and the sending server.
• If the report shows your hosting company's server and DKIM is missing, the website is using the built-in mail function.

How to fix it

1. Choose how to send. Two good options:
   • Your existing mailbox (Google Workspace, Microsoft 365, your host's email) through authenticated SMTP. Fine for small volumes.
   • A transactional email service (many exist, with free plans). Better for shops and higher volumes.
2. Install an SMTP plugin in WordPress. Search the plugin directory for "SMTP": popular plugins let you enter the SMTP server, port, username and password, or connect a transactional service directly. Other website builders and frameworks have a similar "SMTP settings" page.
3. Use secure settings: port 587 with STARTTLS (or 465 with SSL), and a real username and password. For Google and Microsoft, you may need an app password.
4. Use a From address on your own domain, such as noreply@yourdomain.com or shop@yourdomain.com. Never use the visitor's address as From in a contact form: put it in Reply-To instead.
5. Authenticate the service. If you use a transactional service, add its SPF include: to your SPF record and publish the DKIM records it gives you.
6. Protect your forms with a captcha, so bots cannot use them to send spam from your site.

Example SPF record with Google Workspace and a transactional service:

v=spf1 include:_spf.google.com include:spf.transactional-example.com ~all

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Send a new test from your website to your Delivmail test address. The report should show SPF, DKIM and DMARC passing for your domain, and the sending server should now be your provider, not your web host.