Email from the site lands in spam

Email services such as Gmail and Outlook check whether an email really comes from the domain in the sender address. They do this with three DNS records: SPF, DKIM and DMARC. If the records are missing, or the email comes from a server they don't cover, the receiving service can send it to spam or reject it.

By default WordPress sends email straight from the web server. Unless someone has set it up, the web server isn't listed in SPF and the email isn't signed with DKIM. That is why email from the site goes to spam, even when normal email from the same domain gets through.

Check the authentication results

1. Send an email from the site to a Gmail address, for example by requesting a new password for a user with a Gmail address.
2. Open the email in Gmail on a computer, click More next to Reply and choose Show original.
3. Find the Authentication-Results line. It shows the result of each check, for example spf=pass, dkim=pass and dmarc=pass.

If a check says fail, softfail, permerror or none, that is the one to fix. Also check the sender address. If it is wordpress@ or on a domain other than yours, fix that first.

Alternatively, send the email to the address mail-tester.com gives you. You get a score and a list of what lowers it, including the SPF, DKIM and DMARC results.

Send through your email account

SPF and DKIM only help when the email goes through a service that is set up for the domain. Configure WordPress to send with SMTP through your email account, for example with the WP Mail SMTP plugin, and use a sender address on your own domain.

Add SPF

SPF is a TXT record that lists which servers may send email on behalf of the domain. You add it wherever the domain's DNS is managed, for example at your registrar, your hosting provider or Cloudflare.

1. Find the SPF value your email provider gives you. It looks roughly like this:

v=spf1 include:spf.example.com ~all

2. Check whether the domain already has a TXT record starting with v=spf1, for example with MXToolbox. A domain should have only one. If several services send email for you, merge them into that one record.
3. SPF allows at most ten DNS lookups. Every include, a and mx counts, including the lookups inside them. If the record goes over the limit, the result is permerror and the SPF check fails. MXToolbox shows how many lookups the record uses.
4. If the web server sends email directly, its IP address has to be included too, for example with ip4:. On shared hosting you share that address with other customers, who could then also send email for your domain, so SMTP is the better choice there.

Turn on DKIM

DKIM signs every email with a private key held by your email provider, and the receiver checks the signature against the public key in DNS. Your provider gives you one or more DNS records, either TXT or CNAME. Add them exactly as given, and turn on signing at the provider afterwards.

Add DMARC

DMARC tells the receiver what to do with email that fails both SPF and DKIM. For DMARC to accept an email, the domain that passes SPF or DKIM has to match the domain in the sender address. Google recommends waiting 48 hours after SPF and DKIM are in place. Then add a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none means the receiver only reports and doesn't block anything. The reports go to the address in rua. Once the reports show that all the email you send passes the checks, you can tighten the policy to p=quarantine and later p=reject.

Once the records are in place, check them with MXToolbox: SPF, DKIM and DMARC.

Gmail requires SPF or DKIM from every sender, and all three from senders of more than 5,000 emails a day to Gmail accounts. Microsoft has the same requirements for senders of more than 5,000 emails a day to Outlook.com, Hotmail and Live, and since May 2025 it sends email that doesn't meet them to the junk folder.

If email still goes to spam

If all three show pass and the email still goes to spam, the content or the domain's reputation may be the cause. If the domain sends a lot of email to Gmail, Google Postmaster Tools shows the domain's reputation and how much of your email recipients mark as spam. If you don't have access to the domain's DNS, first find out who manages it. If the domain sends email from many services, configuring SPF and DKIM correctly for all of them takes experience.