Guides › WooCommerce
WooCommerce emails going to spam? Here's why, and how to fix it
If order confirmations, "new order" alerts or password resets from your WooCommerce store land in spam, or never arrive, the cause is almost never WooCommerce. It's how WordPress sends email.
The short answer
By default, WordPress hands every email to your web host's mail server. That server isn't listed in your domain's SPF record and doesn't sign messages with your DKIM key. When Gmail, Yahoo or Outlook receive an email "from" orders@yourstore.com that your domain can't vouch for, they filter it to spam or reject it. Since 2024 they have been much stricter about this.
The fix has two parts: make WordPress send through a real email service, then publish the DNS records that prove that service may send for your domain.
Check what's wrong first
Run your store's domain through the free check. It shows your SPF, DKIM and DMARC records in a few seconds. Then place a test order using a Gmail address, open the confirmation (look in spam too), and choose ⋮ → Show original. The top of that page says whether SPF, DKIM and DMARC passed.
Why it happens
1. WordPress sends through your web host
WooCommerce uses WordPress's wp_mail() function. Out of the box it sends through PHP's built-in mail function on your hosting server. On shared hosting that server sends mail for thousands of other sites, its IP address may have a poor reputation, and nothing in your DNS says it's allowed to send as you.
2. The "From" address doesn't match who actually sent it
WooCommerce sends from the address in WooCommerce → Settings → Emails (the "From" address), and WordPress itself defaults to wordpress@yourstore.com. If your SPF record lists only Google Workspace or Microsoft 365, mail sent from your web host fails SPF. With no DKIM signature either, DMARC fails too.
3. DNS records are missing or broken
Common findings: no SPF record, two SPF records (which breaks SPF completely), an SPF record that needs more than 10 DNS lookups, no DKIM for the service that actually sends, or no DMARC record at all.
How to fix it
- Pick one service to send through. If you already pay for Google Workspace or Microsoft 365, it can send your store's mail at low volumes. Busy stores usually use a transactional email service built for order emails.
- Install an SMTP plugin. WP Mail SMTP, FluentSMTP and Post SMTP all route
wp_mail()through the service you picked, so every plugin on the site benefits, not just WooCommerce. - Set one From address everywhere. Use an address on your own domain, such as
orders@yourstore.com, in both the SMTP plugin and WooCommerce's email settings. - Publish SPF. One record only, listing every service that sends as you, and under 10 DNS lookups.
- Turn on DKIM in the sending service and publish the key it gives you.
- Add DMARC. Start with
p=noneand a reporting address, check the reports for a couple of weeks, then move top=quarantine. - Test again with a real order to Gmail and Outlook, and confirm SPF, DKIM and DMARC all pass.
Don't forget the other senders
Your newsletter tool, review requests, abandoned-cart emails, shipping app and help desk may all send "as" your domain too. Each one needs to be in SPF and set up with DKIM, or it will hurt your domain's reputation for all the rest.
Rather not deal with it?
We fix it for $199: we find every tool sending as your store, set up sending and the DNS records, test real orders to Gmail, Outlook and Yahoo, and send a short report. If there's nothing to fix, you don't pay.
Questions
Why do WooCommerce emails go to spam?
By default WordPress hands mail to your web host's server, which isn't listed in your domain's SPF record and doesn't sign with your DKIM key. Gmail, Yahoo and Outlook can't verify the message really comes from your store, so they filter or reject it.
Do I need an SMTP plugin for WooCommerce?
For most stores, yes. An SMTP plugin makes WordPress send through a real email service (your Google Workspace or Microsoft 365 account, or a transactional email service) that your DNS records can vouch for.
Is the problem WooCommerce itself?
No. WooCommerce uses WordPress's built-in wp_mail function, so contact forms, password resets and other plugins have the same problem. Fixing how WordPress sends fixes all of them.
Related: contact form emails going to spam.