Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
WordPress is only the application that creates a message. The recipient’s mail provider decides whether that message reaches the inbox, a spam folder, or nowhere at all. Messages from a site are commonly filtered when they travel through weak hosting mail or PHP mail, lack SPF, DKIM, or DMARC authentication, use a From domain that does not align with authentication, or originate from an IP or domain with poor reputation.
The dependable repair is to send through a reputable SMTP or transactional service, use a From address on your own domain, publish the service’s SPF and DKIM records, add DMARC, verify TLS and forward/reverse DNS, then inspect headers and test delivery at Gmail, Yahoo, and Outlook. Authentication is essential, but it cannot guarantee inbox placement.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
Understand where the spam decision is made
A WordPress form plugin, password-reset routine, or notification function hands a message to the site’s mail transport. WordPress does not control the recipient’s final filtering decision. The receiving provider evaluates the connecting server, DNS records, authentication results, message headers, domain alignment, complaint history, and other reputation signals before accepting and classifying the message.
WordPress is the application layer
WordPress generates the message and requests delivery. On a managed host, the host may provide a mail transfer agent (MTA). On a self-managed server, the site may have no functioning MTA at all. In that case, a remote SMTP server is required. A plugin can provide the interface for that connection, but it does not itself become a delivery network or repair an abused domain.
#1 Best Overall
The transport layer carries the message
SMTP is the protocol used to submit mail. A local PHP-mail path or an unknown shared-hosting server can have weak authentication, a shared IP with poor history, incomplete reverse DNS, or no useful bounce and complaint handling. A reputable SMTP or transactional provider supplies an authenticated relay and documented DNS records; the provider still determines how its infrastructure sends the message.
The recipient provider makes the final call
Gmail, Yahoo, Outlook, and other mailbox operators independently score incoming mail. Passing SPF, DKIM, and DMARC proves important parts of identity and policy, but it does not override spam complaints, a compromised account, an abused domain, or poor sending behavior.
The main reasons WordPress mail is filtered
1. The site uses an unsuitable mail path
WordPress developer guidance warns that an unknown server IP using your domain in the From field can be rejected as spam under SPF. This is common when a site relies on PHP mail or an unconfigured host relay. The recipient sees a message claiming to be from your domain while the connecting infrastructure has no strong, verifiable relationship with that domain.
If your host does not provide a functioning SMTP server, or its shared mail path has a damaged reputation, route WordPress through a remote SMTP relay or transactional service. Do not assume that changing the form plugin will change the server that actually sends the message.
2. SPF, DKIM, or DMARC is missing or misaligned
SPF is a DNS TXT record that lists systems authorized to send mail for a domain. DKIM adds a cryptographic signature that lets the receiving server verify the signing domain. DMARC tells the receiver what to do when SPF or DKIM fails and requires the authenticating domain to align with the visible From domain for DMARC authentication.
Rank #2
- Upgraded Two Zipper Pockets: Forvencer server books feature two secure zipper pockets for better organization of coins, cash, and receipts, ensuring that everything you collect has a safe and secure place
- Smart Storage & Quick Access: Designed with 8 multi-functional compartments, the right side includes a guest receipt pad, while the left has a money pocket, ticket pocket, and credit card slot. Two small clear pockets store bills, receipts, and other visible items. A stitched pen loop ensures you always have your favorite pen ready
- High-quality & Easy to Clean: Crafted from high-quality PU leather with heavy-duty stitching, this server book is built to last. It resists tears, scratches, and its waterproof surface makes cleaning easy with just a damp cloth or a non-chlorine sanitizer
- Perfect Fit for Your Apron: Measuring 5” x 8”, this compact organizer is slightly smaller than other models, making it ideal for bending or sitting while carrying in your server apron. It holds everything a waitress needs—a place for everything
- What's Included: This server organizer comes with multiple open and zippered pockets to store money, receipts, tips, etc. Clear sleeves are perfect for keeping menus or special lists while serving. Available in a variety of colors, allowing you to express yourself even when in uniform
Typical failures include publishing no record, publishing more than one SPF record, forgetting a legitimate third-party sender, copying a provider record to the wrong hostname, or authenticating one domain while displaying another in From. A message can show an SPF pass for a return-path domain yet fail DMARC if that domain does not align with the visible From domain.
3. DNS, TLS, or reverse DNS is incomplete
Recipient providers expect the sending infrastructure to identify itself consistently. Google requires valid forward and reverse DNS for the sending IP and TLS for mail transmission. A missing or mismatched PTR record, an A record that does not point back to the same host, or an SMTP connection without TLS can hurt acceptance even when WordPress settings are correct.
4. The domain or IP has poor reputation
Authentication establishes identity; it does not erase history. Spam complaints, hacked forms, stolen credentials, high bounce rates, or a shared hosting IP used by abusive senders can continue to affect delivery. Removing the immediate configuration error is only the first step. You must also secure the site and control who can trigger messages.
5. Recipient behavior signals unwanted mail
Messages sent to invalid, abandoned, or unengaged addresses generate bounces and complaints. Repeated unsolicited notifications can produce the same outcome even when every DNS record passes. Keep transactional messages tied to an action the recipient requested, and stop sending to addresses that repeatedly fail.
Fix WordPress delivery in the right order
- Choose the sending identity. Set the visible From address to a mailbox on the site’s own domain, such as
notifications@example.com. Use Reply-To for the human mailbox that should receive responses. The From mailbox must be monitored or at least exist according to your mail setup; do not use a visitor’s address as From. - Choose the transport. Connect WordPress to a reputable SMTP or transactional provider. A WordPress SMTP plugin supplies the connection interface and stores the credentials, while the provider supplies the relay, authentication instructions, and delivery infrastructure. Confirm the provider’s retention, data-processing location, volume limits, and logging before choosing it.
- Publish one SPF record. Add the provider’s documented include mechanism or sending IP authorization to the domain’s single SPF TXT record. Merge it with authorizations for every other legitimate sender, such as a separate support or newsletter system. Multiple SPF records at the same domain are not a valid way to combine services; consolidate them into one record.
- Enable DKIM. Create or obtain the provider’s DKIM selector and publish its public key at the specified DNS name. Verify that outgoing messages receive a DKIM pass. Google requires at least a 1024-bit key for mail sent to personal Gmail accounts and recommends 2048 bits when the provider supports it.
- Add DMARC gradually. Publish a DMARC TXT record for the From domain with a monitoring policy such as
p=none. Review reports and confirm that every legitimate source passes SPF or DKIM with alignment to the visible From domain. Tighten the policy only after legitimate traffic is accounted for; a stricter policy applied too early can reject your own notifications. - Verify DNS and TLS. Confirm that the sending IP has a valid PTR (reverse-DNS) record and that forward DNS points back consistently. Check that the SMTP connection negotiates TLS. These checks belong to the sending service or host; a WordPress setting cannot create a PTR record for an IP you do not control.
- Send controlled tests. Trigger a real password-reset message and a form notification rather than only sending a test generated by the plugin. Deliver to Gmail, Yahoo, and Outlook accounts. Save the complete headers and compare authentication results, From and return-path domains, sending IP, and timestamps.
- Improve reputation. Remove compromised forms and accounts, rotate exposed SMTP credentials, add rate limits or abuse protection, and stop sending to addresses that bounce repeatedly. Monitor complaint and reputation feedback from your provider. A plugin cannot repair a poisoned IP or an abused domain by itself.
Configure SPF, DKIM, and DMARC without creating new failures
SPF: authorize every real sender once
SPF is evaluated for the envelope sender, not simply the address displayed in the From field. Your provider will give you the exact TXT value, usually containing an include: statement or an IP range. Add that value to the existing SPF record rather than creating a second record. Include all systems that legitimately send as your domain, and remove services you no longer use. An SPF pass alone is not enough when its domain is different from the visible From domain.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
DKIM: sign with the domain shown to readers
The provider publishes a public key in DNS and signs each message with the corresponding private key. The selector in the message header tells the receiving server where to find that key. If the selector is wrong, the key is truncated, or DNS returns an old value, DKIM fails. Use at least a 1024-bit key; 2048 bits is the recommended choice when supported. Test a newly signed message after every selector or provider change.
DMARC: enforce alignment and policy
DMARC checks whether SPF or DKIM passes with a domain aligned to the visible From domain. Its policy tells receiving providers whether to take no action, quarantine, or reject messages that fail. Begin with monitoring (p=none) so you can identify legitimate WordPress, support, and marketing senders. Move to a stricter policy only after reports show that authorized sources pass and unauthorized sources are understood.
Gmail requirements that affect WordPress senders
Google’s sender guidance changed the baseline for mail sent to personal Gmail accounts. The dates and thresholds below apply to Google’s stated requirements, not to every mailbox provider.
| Situation | Requirement or guidance |
|---|---|
| All senders, starting February 1, 2024 | Set up SPF or DKIM for the sending domain. |
| More than 5,000 messages per day to Gmail accounts | Set up SPF, DKIM, and DMARC; maintain valid forward and reverse DNS; use TLS; and keep the reported spam rate below 0.30%. |
| DKIM for personal Gmail delivery | Use a key of at least 1024 bits; Google recommends 2048 bits when supported. |
Google recommends setting up SPF, DKIM, and DMARC for every domain, even when your WordPress site sends far fewer than 5,000 messages daily. Passing these checks lowers the chance of rejection or spam classification, but Google does not promise inbox placement.
Compare the practical sending options
| Option | Authentication and alignment | DNS, TLS, and reputation control | Logs and failure handling | Best fit |
|---|---|---|---|---|
| Host-provided mail path | Depends on the host; SPF, DKIM, and DMARC support may be limited or unclear. | PTR, shared-IP reputation, and TLS are controlled by the host. | Basic logs may be available; bounce and complaint tools vary. | Small sites whose host documents a reliable, authenticated mail service. |
| WordPress SMTP plugin plus an SMTP provider | The plugin submits mail; the provider supplies SPF, DKIM, and alignment instructions. | Provider controls relay TLS and IP reputation; you control your domain DNS. | Usually provides provider logs plus the plugin’s local error log. | Most sites that need dependable form, reset, and notification delivery. |
| Dedicated transactional service | Designed for authenticated, domain-aligned application mail. | More visibility into sending identity, DNS requirements, and reputation; contractual limits apply. | Typically includes event logs, bounces, complaints, and suppression controls. | Sites with higher volume, several applications, or formal monitoring needs. |
No option guarantees that every message reaches the inbox. Compare providers on SPF, DKIM, DMARC and alignment support; TLS and PTR responsibility; sending-IP reputation; header and event visibility; bounce and complaint handling; volume limits; geographic data-processing requirements; setup complexity; and total cost.
Rank #4
- Upgraded Magnetic Closure Pocket and Two Zipper Pockets: Unlike other brands, Forvencer server books are designed with two secure zipper pockets and two expandable magnetic pockets. These allow you to easily store and organize a large number of coins, cash, and receipts.
- Smart Storage & Quick Lookup: 10 multi-functional compartments. On the right side has a check pad, and on the other has a Money Pocket, Tickets Pocket and Credit Card Slot. Two small clear pockets can store bills, receipts and other items to be viewed. A stitched pen loop to store your favorite pen.
- Long-Lasting and Easy to Clean: Serving book features high-quality PU leather and heavy-duty stitching. PU is extremely strong with high tensile strength and good resistance to tearing, abrasion and scratching. Waterproof leather makes it simple to wipe down your server book with warm water or non-chlorine sanitizer solution to remove any dirt, soil, grime, or soda residue to keep it clean.
- Fit Perfectly in your Apron: Our 5" x 9" server book is designed to accommodate regular checks and fit easily in your apron pocket.
- What You Get: Forvencer server book in strict quality control, our worry-free 1-Year warranty, and friendly customer service.
Inspect a real message instead of guessing
Use a genuine WordPress event
Trigger a password reset, account notification, or contact-form submission. A provider dashboard test may use a different path and prove less than a real production message. Record the exact From, Reply-To, recipient, and time so you can find the event in the relay log.
Read the complete headers
In Gmail’s web interface, open the message, select the three-dot menu, and choose Show original. Look for the Authentication-Results header and confirm SPF, DKIM, and DMARC outcomes. Also note the envelope-from or return-path domain, the DKIM signing domain, the visible From domain, the sending IP, and whether the server negotiated TLS. Other providers expose equivalent “view source,” “message details,” or raw-header controls, although labels vary.
Interpret the combinations
- SPF fail and DKIM fail: the provider is not authorized or the message is bypassing the configured relay. Check the SMTP host, credentials, and SPF record.
- SPF pass but DMARC fail: the SPF-authenticated domain is not aligned with the visible From domain. Correct the From identity or configure aligned authentication.
- DKIM fail: inspect the selector, public key, DNS name, and provider signing setting.
- All authentication passes but mail is spam: investigate complaints, compromised accounts, shared-IP reputation, message behavior, and recipient engagement rather than repeatedly editing DNS.
- No message in provider logs: WordPress may be failing before submission. Check plugin error logs, SMTP credentials, firewall rules, and the site’s PHP error log.
Troubleshoot by symptom
Contact-form mail never arrives
- Confirm the form reports a successful submission and that WordPress records an SMTP submission attempt.
- Check the provider event log for accepted, deferred, bounced, or rejected status.
- Verify that the form’s From address is on your domain and that Reply-To contains the visitor’s address.
- Inspect the recipient mailbox’s spam folder and full headers before changing settings.
Password resets work for some providers but not others
Different mailbox providers apply different reputation and policy thresholds. Compare the headers and SMTP response for Gmail, Yahoo, and Outlook. If authentication differs, fix DNS or provider configuration. If authentication is identical, examine provider-specific reputation, complaint, and rate signals rather than assuming WordPress generated different mail.
Mail stopped after adding a new service
Check SPF first. A second TXT record or an unmerged provider include can invalidate SPF. Then check DMARC reports for the new sender and add its DKIM or aligned SPF authorization. Keep a written inventory of every service permitted to send as the domain.
Mail stopped after changing hosts
The old host may have supplied the only working relay, DKIM signature, or reverse-DNS configuration. Reconnect WordPress to the intended SMTP service, republish the provider’s current DNS values, and verify the new sending IP’s PTR and forward DNS. Do not copy old records blindly.
Protect reputation after the technical fix
- Use separate credentials for WordPress, the SMTP service, and administrators; rotate them if a form or account was compromised.
- Restrict who can trigger high-volume notifications and add rate limits to public forms.
- Keep the visible From domain consistent across transactional messages.
- Use Reply-To for visitor responses instead of impersonating the visitor in From.
- Remove invalid addresses and suppress recipients who repeatedly bounce or complain.
- Review provider logs and DMARC reports regularly, especially after installing a new plugin or external service.
- Keep TLS enabled and maintain accurate forward and reverse DNS for infrastructure you control.
What an SMTP plugin can and cannot do
An SMTP plugin can replace the local PHP-mail path, authenticate to a relay, expose connection errors, and make WordPress use the From and Reply-To values you specify. It cannot publish DNS records, create a PTR record for a provider-owned IP, change a shared IP’s reputation, remove spam complaints, or force Gmail, Yahoo, or Outlook to place a message in the inbox. Treat it as an implementation aid inside a complete authentication and reputation plan.
Quick Recap
A repeatable maintenance checklist
- From uses a mailbox on the site’s domain; Reply-To points to a monitored reply address.
- One SPF TXT record contains every legitimate sender.
- DKIM is enabled, its selector is published, and signatures pass with a 1024-bit-or-larger key (2048 bits recommended when supported).
- DMARC is published, initially monitored, and aligned with the visible From domain.
- The sending IP has valid PTR and matching forward DNS where applicable.
- SMTP uses TLS.
- Real WordPress password-reset and form messages are tested at Gmail, Yahoo, and Outlook.
- Headers, provider events, bounces, complaints, and reputation signals are reviewed after configuration changes.
- Forms, accounts, plugins, and SMTP credentials are protected against abuse.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
