Email Authentication for WordPress

TL;DR: WordPress uses PHP's mail() by default, which sends email from your server's IP with no DKIM signature — nearly always fails DMARC. The fix is a dedicated SMTP plugin (WP Mail SMTP or FluentSMTP) pointed at a real email provider, plus correct SPF, DKIM and DMARC records on your domain. Scan your domain free to see which records are missing right now.

Why WordPress email authentication usually fails

Out of the box, WordPress calls PHP's mail() function to send password resets, WooCommerce order emails, contact form notifications and more. This sends from whatever server PHP runs on — typically your shared hosting server — using the server's IP address and no DKIM signature. The result:

• The sending IP is not in your SPF record → SPF fails
• No DKIM signature → DKIM fails
• Both fail → DMARC fails
• Emails land in spam or are rejected outright

This affects every email WordPress sends: WooCommerce orders, new user registrations, password resets, Contact Form 7 / WPForms notifications, and any plugin that triggers email.

Step 1 — Install an SMTP plugin

Replace PHP's mail() with proper SMTP delivery. Two reliable free options:

Install via Plugins → Add New, then configure with credentials from your chosen email provider (see Step 2).

Step 2 — Choose a sending provider

Your WordPress site now sends through a real email infrastructure rather than the PHP server. Common options for small businesses:

Step 3 — Fix your SPF record

After switching to an SMTP provider, add that provider's include to your SPF TXT record at the root domain. One SPF record only — if you already have one, add the include to it:

Example for a site using Google Workspace for staff email and Brevo for WooCommerce:

v=spf1 include:_spf.google.com include:spf.sendinblue.com ~all

Keep the total number of DNS lookups under 10. SPF too many lookups guide.

Step 4 — Enable DKIM via your provider

Each provider has a DKIM setup flow. They give you a DNS record (TXT or CNAME) to add to your domain — this publishes your public key so receivers can verify the signature.

• Brevo: Settings → Senders & IP → Domains → Authenticate. Add the two CNAME records they provide.
• Mailgun: Sending → Domains → your domain → DNS records. Add the TXT record for mailo._domainkey.yourdomain.com.
• SendGrid: Settings → Sender Authentication → Domain Authentication. Add three CNAME records.
• Google Workspace: Admin console → Apps → Gmail → Authenticate email. Generate and add the TXT record at google._domainkey.yourdomain.com.

Wait 15–60 minutes for DNS propagation, then run a Kalenfy scan to confirm dkim=pass.

Step 5 — Add a DMARC record

Once SPF and DKIM are passing, add a DMARC record at _dmarc.yourdomain.com. Start with p=none to monitor, then escalate to p=reject:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

After two weeks of reports showing only legitimate senders, change to p=quarantine then p=reject. Full guide: What is DMARC.

Step 6 — Test everything

Use the SMTP plugin's built-in test email feature to send a test message, then check the Gmail raw headers for spf=pass dkim=pass dmarc=pass. Or scan your domain at Kalenfy to check all three records at once.

WooCommerce-specific notes

• From address: WooCommerce sends from the address in WooCommerce → Settings → Emails → From address. This must be on the same domain your DKIM and SPF cover — not a Gmail or Hotmail address.
• Order volume: High-volume stores (>500 orders/day) should use a dedicated transactional email service rather than a shared SMTP relay.
• Test order emails: Place a test order and check the order confirmation lands in inbox (not spam) and shows correct authentication in headers.

FAQ

My WordPress contact form emails go to spam — is this the same problem?

Yes. Contact Form 7, WPForms, Gravity Forms and similar plugins all use wp_mail() which calls PHP's mail() by default. Installing an SMTP plugin redirects all WordPress email through proper infrastructure — contact forms included.

Do I need a paid email provider?

For low-volume sites, free tiers (Brevo 300/day, SendGrid 100/day) are enough. For WooCommerce stores with significant order volume, a paid plan on Mailgun or Brevo (typically £5–20/month) is worth the deliverability guarantee.

Will this fix WooCommerce order emails going to spam?

In most cases, yes — poor email authentication is the most common cause of WooCommerce emails landing in spam. If emails still hit spam after fixing authentication, check whether your domain or IP is on a blacklist: how to get off an email blacklist.

I use a managed WordPress host (Kinsta, WP Engine, Flywheel) — does this apply?

Yes. Managed hosts still use PHP mail by default for WordPress email — they just manage the server, not your DNS records. You still need an SMTP plugin plus SPF/DKIM/DMARC on your domain.