WordPress emails going to spam? Check the sender before the plugin

A customer says the order email never came, then finds it in spam. If your WordPress emails are going to spam, the plugin that wrote them is rarely the cause. The inbox is judging who sent them.

Why are your WordPress emails going to spam?

Gmail, Yahoo and Outlook check whether the server that delivered a message is allowed to send for the domain in the From line. WordPress hands mail to the web server, which is often not on the list of servers your domain trusts.

When the check fails, the message is often filed as spam with no error on your side.

Which address does WordPress send from?

On a fresh WordPress 7.1.3 site in our 15 Oct 2026 lab, the From address was wordpress@ followed by the site’s domain. WordPress core builds it that way in pluggable.php when no plugin sets a sender. Few owners ever create that mailbox.

WooCommerce does it differently. In our 13 Oct 2026 lab, WooCommerce 11.2.1 sent order emails from the admin email, with the site title as the sender name. If that admin email is a Gmail or Yahoo address, the message claims to come from Gmail while leaving your web host. The inbox has no reason to trust it.

That is why password resets may arrive while order emails land in spam, or the other way round. The full order email test is in why WooCommerce is not sending order emails.

On sites under our WordPress care plan, and on the stores we look after under WooCommerce store care, we set one sending route for every plugin and check where each email type lands.

What do SPF, DKIM and DMARC have to do with it?

They are the DNS records an inbox reads before it trusts a message. SPF lists the servers allowed to send for your domain. DKIM adds a signature the inbox can check against a public key in your DNS. DMARC tells the inbox what to do when both fail, and where to send reports.

Google’s sender guidelines ask every sender to set up SPF or DKIM. They say mail without them might be marked as spam or rejected. Google wants your spam complaint rate under 0.10% and never at 0.30%; Yahoo says under 0.3%.

What did our own records show?

We looked up distrocode.com with dig on 17 Oct 2026. The SPF record reads v=spf1 include:_spf.mail.hostinger.com ~all. The DMARC record reads v=DMARC1; p=none.

That SPF record trusts our email provider’s servers and nothing else. The ~all at the end is a softfail under RFC 7208: mail from any other server should be treated as suspect, not refused. If a WordPress site on this domain sent straight from its web server, that mail would not pass SPF, and with no DKIM signature it would have nothing else to fall back on.

DMARC at p=none asks inboxes to take no action and only report. It is the minimum Google asks of anyone sending 5,000 or more messages a day to Gmail.

Does WordPress tell you when an email fails?

Not reliably. In our 15 Oct lab, wp_mail() returned false and logged “Could not instantiate mail function.” The lab ran on WordPress Playground, which has no mail service at all. A real host usually has one. There the call can return true, the message leaves the server, and the inbox still files it as spam. The whole wp_mail() test is in why a WordPress contact form is not sending email.

WooCommerce writes an order note when it hands off an email. That note proves the hand-off, not the delivery.

How do you stop WordPress emails going to spam?

Work in this order:

1. Pick one From address on your own domain, such as orders@ or hello@, and create the mailbox so replies land somewhere.
2. Send the site’s mail through an SMTP service or your email provider instead of the web server.
3. Add that service to your SPF record and turn on its DKIM signing for your domain.
4. Set every plugin that sends mail, WooCommerce and the form plugin included, to the same From address.
5. Add a DMARC record at p=none with a report address, then read the reports for a week or two.

An SMTP plugin is step 2, not the whole fix.

How do you check where your emails land?

Send a password reset, a form message and a test order to a Gmail address you own. Open the message in Gmail, click More (the three dots) next to Reply, choose Show original, and read the SPF, DKIM and DMARC lines at the top. All three should say PASS for every email type.

Repeat it after a host move or a new plugin, since both can change the route. If the site also sends crash warnings, the WordPress “technical issue” email explains that one.

What should you do right now?

Send yourself a password reset from your own site and read its headers. If SPF or DKIM does not say PASS, the sender is the problem, not the plugin.

Want us to look instead? Send the site address and one email that landed in spam. We do a free site check and reply within 2 business days with a written report on why it was filtered and the work to fix it. Send us the site and the email. A new site fix goes up each day on DistroCode’s LinkedIn Page.

Not sure what is wrong yet? Ask for the free site check: send the site address and we reply in writing within 2 business days. If you already know what to fix, the one-off fixes are listed here.