Your customer places an order, and the order confirmation lands in their spam folder, or never arrives at all. They assume the order failed, email you to ask, or open a dispute with their bank.
The good news: this is almost never a WooCommerce bug. It's how your WordPress site sends email, and it's fixable in an afternoon. This guide explains why it happens and walks through the fix step by step.
Why WooCommerce emails end up in spam
WooCommerce doesn't send email itself. It hands every message (new order, processing, completed, password reset) to WordPress, which hands it to whatever mail setup your site has. Gmail, Outlook and Yahoo then decide whether to trust it. Four things usually make them say no.
1. Your site is sending with PHP mail()
Out of the box, WordPress sends through PHP's mail() function. That means your web hosting server sends the email, not a real email service. Mail providers have no good reason to trust a random web server claiming to send for your domain, and shared hosting servers often send for hundreds of other sites too.
This is the single most common cause of WooCommerce emails going to spam.
2. SPF doesn't include the server that actually sends
SPF is a DNS record that lists which servers are allowed to send email for your domain. If your site sends from the hosting server but your SPF record only lists, say, Google Workspace, the receiving server sees an unauthorised sender.
3. No DKIM signature
DKIM adds a cryptographic signature to each email, proving it really came from your domain and wasn't changed on the way. Emails sent through PHP mail() usually have no DKIM signature for your domain at all.
4. No DMARC policy, or a "From" address that doesn't match
DMARC tells mail providers what to do when SPF and DKIM don't line up with the address in the "From" field. Without it, or when your store sends "From" an address on a different domain, providers have less reason to trust the message.
Step 1: Find out what's actually wrong
Before changing anything, look at a real email your store sends. Guessing wastes time: the problem is often not what you'd expect.
The quickest way is to send a test to WP Mail Tester. Copy the test address, then send an email to it from your site. WooCommerce stores can place a test order using that address as the customer email, which tests the exact email your customers receive. Within about a minute you'll see whether SPF, DKIM and DMARC pass, your spam score, and whether your site is using PHP mail().
Step 2: Send through a real email service with an SMTP plugin
This fixes the biggest problem in one go. Instead of your web server sending email, an SMTP plugin hands every WordPress email to a proper transactional email service.
- Pick a transactional email provider. Brevo, Mailgun, Postmark, SendGrid and Resend are all built for this. Brevo's free plan is enough for most small stores.
- Install an SMTP plugin. WP Mail SMTP, FluentSMTP and Post SMTP are all free and widely used.
- Connect the plugin to your provider using the provider's API key. The plugin's setup wizard walks you through it.
- Verify your domain with the provider. The provider gives you DNS records to add (usually for SPF and DKIM). This step is what makes your emails trusted, so don't skip it.
Once this is done, your emails come from servers that mail providers recognise, signed for your domain.
Before you change any DNS records: take a screenshot of your current DNS records, or use your DNS provider's export option if it has one. If something goes wrong, you can put everything back exactly as it was.
Step 3: Fix your SPF record
Your domain can only have one SPF record. If you add a second one, both stop working.
Open your DNS settings (at your domain registrar, Cloudflare or your host) and find the TXT record that starts with v=spf1. Add your email provider's include: to it rather than creating a new record. For example, a domain using Google Workspace for mailboxes and Brevo for the website might have:
v=spf1 include:_spf.google.com include:spf.brevo.com ~all
Your email provider tells you the exact include: value to use.
Step 4: Add DKIM
DKIM records come from your email provider during domain verification in Step 2. They're usually one or more TXT or CNAME records with names like brevo1._domainkey. Copy them exactly as given: a single missing character breaks the signature.
If you also send from Google Workspace or Microsoft 365, set up DKIM there too. Each service that sends for your domain needs its own DKIM record.
Step 5: Add a DMARC record
If your domain has no DMARC record, add one. Start in monitoring mode, which doesn't block anything:
Name: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:you@yourdomain.com
p=none tells providers to deliver as normal while you confirm everything passes. Once SPF and DKIM have been passing for a few weeks, you can tighten it to p=quarantine.
Step 6: Match WooCommerce's sender settings to your domain
Go to WooCommerce → Settings → Emails and scroll to Email sender options.
- "From" name: your store name.
- "From" address: an address on your own domain, such as
orders@yourstore.com. Never use a Gmail, Yahoo or Hotmail address here. Those providers publish strict DMARC policies, so mail claiming to come from them but sent from your site gets rejected or spam-foldered.
In your SMTP plugin, use the same From address, and turn on its "force From email" option if it has one, so every plugin on your site sends from the same verified address.
If customers will reply to order emails, make sure that address can actually receive mail, or set a Reply-To address that does.
Step 7: Test again
DNS changes can take anywhere from a few minutes to a few hours to update. Then send another test, ideally another test order, and confirm:
- SPF passes
- DKIM passes
- DMARC passes
- Your site is no longer sending through PHP mail()
- The spam score is low
If everything passes, your order emails have the best possible chance of reaching the inbox.
Quick checklist
- An SMTP plugin sends your emails through a real email service, not PHP mail()
- Your domain is verified with that email service
- Your domain has one SPF record that includes the email service
- DKIM is set up for every service that sends as your domain
- Your domain has a DMARC record (start with
p=none) - WooCommerce's "From" address is on your own domain
- A test order passes SPF, DKIM and DMARC
Common questions
My emails used to work. Why did they start going to spam?
Usually something changed: a plugin update reset your SMTP settings, an API key expired, your host moved you to a new server, or someone edited your DNS and broke the SPF record. Re-running a test shows which one.
Do I need a paid email service?
Not usually. Free plans from Brevo and Mailgun cover the email volume of most small and medium stores. What matters is sending through a real service with your domain verified, not the price.
Will this fix emails from my contact form too?
Yes. Contact Form 7, WPForms, Gravity Forms and other form plugins send through the same WordPress mail system, so once WordPress sends through an SMTP service, they benefit too.
Some customers still don't get emails after the fix. Why?
Check whether your sending IP or domain is on a blacklist, and whether the customer's own inbox has filters or a full mailbox. A deliverability test shows blacklist status and every authentication check in one report.