A user clicks "Lost your password?", waits for the reset link, and nothing arrives. Or it lands in spam, where they never look. They can't log in, so they give up, or email you to complain.
Password reset emails are sent by WordPress itself, not a plugin, and they have a few weaknesses that make them especially likely to be filtered. Here's why, and how to fix it.
Why password reset emails get filtered
1. They come from an address that doesn't exist
Unless something changes it, WordPress sends its own emails from:
wordpress@yourdomain.com
Most sites never create that mailbox. An email from an address that can't receive replies, sent by your web server, looks suspicious to spam filters. It also means any user who replies gets a bounce.
2. They're sent with PHP mail()
Like all WordPress emails, password resets go out through PHP mail() by default, sent by your web hosting server rather than a proper email service. This is the biggest single cause of WordPress emails going to spam. Our guide to PHP mail vs SMTP explains why.
3. Your domain's authentication records don't cover the sender
If your SPF record doesn't include the server that sends the email, and there's no DKIM signature for your domain, receiving servers can't confirm the email is genuine. With a DMARC policy in place, the email may be quarantined or rejected outright. See SPF, DKIM and DMARC for WordPress.
4. They look like phishing
A short email containing a login link is exactly what phishing emails look like. Spam filters look at password-reset emails more closely, so a weak sender setup is more likely to tip them into spam than it would for other emails.
How to test your password reset email
Testing with your own account only tells you whether your inbox accepts it. To see the full picture:
- Get a free test address from WP Mail Tester.
- In WordPress, go to Users → Add New and create a test user with that address as its email.
- Go to your login page, click Lost your password?, and enter the test user's username or email.
Within about a minute you'll see whether SPF, DKIM and DMARC pass, the spam score, the From address used, and whether your site sent it through PHP mail(). Delete the test user afterwards.
How to fix it
1. Send through a real email service
Install an SMTP plugin such as WP Mail SMTP, FluentSMTP or Post SMTP, and connect it to a transactional email service like Brevo, Mailgun, Postmark or SendGrid. Verify your domain with the service by adding the DNS records it gives you. This adds a DKIM signature and moves your emails onto a trusted sending service.
2. Change the From address and force it
In your SMTP plugin, set the From Email to a real address on your domain, for example hello@yourdomain.com or noreply@yourdomain.com, and turn on Force From Email. This replaces wordpress@yourdomain.com on every email WordPress sends, including password resets and new-user emails.
Set a recognisable From Name too, such as your site or business name, so users know who the email is from.
3. Make sure replies don't bounce
If you use a noreply@ address, users who reply get a bounce, which is a poor experience. Either use an address someone reads, or set a Reply-To address that does receive mail.
4. Check SPF, DKIM and DMARC
Make sure your domain has:
- One SPF record that includes your email service.
- The DKIM record(s) from your email service.
- A DMARC record, starting with
p=none.
5. Test again
Repeat the test with the test user. You should see SPF, DKIM and DMARC passing, your new From address, and your email service as the sending method instead of PHP mail().
Common questions
Users say they never get the reset email at all, not even in spam. Why?
If nothing arrives anywhere, your host may be blocking or limiting PHP mail(), or the email is being rejected outright because of a strict DMARC policy and failing authentication. Sending through an email service usually fixes both, and its logs show whether each email was delivered.
Do I need a plugin to change the WordPress From address?
An SMTP plugin's "force From email" setting is the simplest way, because you need the plugin anyway to stop using PHP mail(). Changing the address alone, without fixing how email is sent, rarely solves the problem.
Does this fix WooCommerce and form emails too?
Yes. They all go through the same WordPress mail system. See WooCommerce order emails going to spam and contact form emails not arriving.