WordPress emails fail because WordPress uses PHP’s mail() function by default, which most hosts block or leave unauthenticated. The fix is to route mail through authenticated SMTP using a plugin like WP Mail SMTP, set a real From address on your domain, and add SPF, DKIM and DMARC records to your DNS.
This is the most expensive silent failure in WordPress. Your contact form says “message sent,” the customer believes you received it, and nothing arrives. There is no error, no warning, no red banner. Businesses lose enquiries for months this way. This guide fixes it properly, and it starts with something most guides skip: working out which of three different problems you actually have, because they need three different fixes.
Why WordPress email fails in the first place
WordPress sends mail through PHP’s built-in mail() function, which dates back decades and includes no authentication. It simply hands a message to the server and hopes.
That creates two problems in 2026. Many hosts disable or restrict mail() entirely, because spammers abuse it, so the message never leaves. And when it does leave, it carries nothing proving it is legitimate, so receiving servers treat it as suspicious and either filter it to spam or reject it outright.
The failure stays silent by design. When mail() fails, wp_mail() returns false and WordPress moves on. Your form still displays its success message, because the form succeeded. Only the email failed.
SMTP fixes this by connecting WordPress to a real, authenticated mail server using proper credentials and encryption. The receiving server can then verify who sent the message.
First: which problem do you actually have?
People describe three completely different failures as “WordPress is not sending emails,” and applying the wrong fix wastes days. Identify yours before changing anything.
| What is happening | What it means | Where the fix lives |
|---|---|---|
| No email anywhere, not even in spam | Mail never leaves your server, or the receiving server rejects it | SMTP setup, then DNS authentication |
| Email arrives but lands in spam | Mail sends fine; it is a trust problem | Authentication records and From address |
| Some emails work, others do not | The mail system works; one notification points somewhere wrong | The form, plugin or WooCommerce setting |
That third row catches a lot of people. If your password reset emails arrive but your contact form notifications do not, your mail works perfectly and your form’s notification settings are the problem. No amount of SMTP configuration will fix a notification pointing at the wrong address, or one you switched off months ago.
And the detail that misleads everyone: a form’s success message only proves the form processed your submission. It proves nothing about whether WordPress created an email, sent it, or delivered it. Never use it as evidence.
Step 1: Test properly
Two tests, in this order, tell you which problem you have.
Test the WordPress mail layer. Most SMTP plugins include a test email tool, and it reports whether WordPress managed to hand the message off at all. A failure here means mail is not leaving. A success here does not mean it arrived.
Next, test the delivery layer. Send a message to an address on a different provider than your own (a Gmail address if your business mail is Outlook, for example), and check the spam folder as well as the inbox. Then run one message through a tool like Mail-Tester, which scores the message and shows exactly which authentication checks passed or failed. This is the fastest way to see whether you have a sending problem or a trust problem.
Finally, test the notification layer. Submit your own contact form and check the plugin’s entries or logs. If the plugin records the entry but never attempts an email, the notification setting is your issue.
Step 2: Set up SMTP
This is the core fix and takes about fifteen minutes.
Install an SMTP plugin. WP Mail SMTP covers what most sites need and costs nothing; FluentSMTP is a solid free alternative. The plugin intercepts wp_mail() and routes everything through a proper mail server instead of PHP mail().
Then choose what it connects to:
| Mailer | Good for | Watch out for |
|---|---|---|
| Your host’s own mailbox | Small sites already using domain email | Shared IP reputation, host limits |
| Gmail / Google Workspace | Low volume, existing Workspace users | Roughly 500 emails a day free, 2,000 on Workspace; needs an App Password |
| Brevo | Most small business sites | Free tier limits |
| Mailgun / SendGrid | Stores and higher volume | Requires DNS verification, worth doing anyway |
For a business site taking enquiries, a dedicated sending service beats routing through a personal mailbox, because the service’s whole job is delivery and it gives you logs when something fails.
Which SMTP port should you use?
Use 587 with TLS as your default, since it is the modern standard. If 587 refuses to connect, try 465 with SSL. Avoid port 25 entirely, since it carries no authentication and almost every network blocks it. Some hosts leave 2525 open as an alternative.
What if your host blocks SMTP completely?
Check this before you fight the settings. Some managed hosts block outbound SMTP by design, WP Engine, Kinsta and Flywheel among them. On those platforms no port will work, and an API-based mailer (Brevo, Mailgun or SendGrid, connecting over an API key rather than an SMTP port) is the only route. Ask your host directly: “do you block outbound SMTP on ports 587 and 465, and do you require an internal relay?” That one question saves hours.
Step 3: Set a real From address
This trips people up constantly. Your From address must be a real, working mailbox on the domain you are sending from.
A made-up noreply@yourdomain.com fails if that mailbox does not exist. So does using a Gmail or Yahoo address as the From on mail sent from your own domain, because the sending domain and the From domain no longer match, which is exactly what modern authentication checks for.
Set it in your SMTP plugin’s settings, use an address you actually control, and enable the “force from email” option so individual plugins cannot override it with something invalid.
Step 4: Add SPF, DKIM and DMARC (this is now mandatory in practice)
These three DNS records tell receiving servers your mail is legitimate. Without them, delivery in 2026 is unreliable at best.
What each record does
- SPF lists which servers may send email for your domain.
- DKIM adds a cryptographic signature proving nobody altered the message and that it came from you.
- DMARC tells receivers what to do when SPF or DKIM fails, and gives you reporting.
Your mail provider supplies the exact records to add; you add them in your DNS (usually at your domain registrar or Cloudflare). Check what you currently have with a free tool like MXToolbox.
Why the rules got serious
Google and Yahoo began requiring authentication from bulk senders in February 2024, Microsoft followed in May 2025, and enforcement hardened significantly. What began as temporary deferrals became permanent rejections, meaning receiving servers now refuse non-compliant messages before they reach any folder, spam included. Reported figures put compliant senders around 89% inbox placement, while non-compliant senders lose a large share of their mail to rejection and filtering.
Two clarifications matter for a WordPress site.
The volume threshold applies to bulk sending, but every provider expects authentication from everyone. Those bulk sender rules formally apply above 5,000 emails a day, and transactional email escapes the one-click unsubscribe requirement. Authentication carries no such exemption, since all three providers recommend SPF, DKIM and DMARC regardless of volume. A small business site sending twenty enquiry notifications a day is not a bulk sender, and still loses mail to filters without them.
If you take card payments, DMARC becomes a compliance question. PCI DSS version 4.0 introduced an anti-phishing requirement that became mandatory, and enforcement began in 2026. DMARC is how organisations handling card data satisfy it. For a WooCommerce store, that moves DMARC from a deliverability improvement to a requirement.
The alignment trap
Here is the failure that confuses experienced people: SPF and DKIM can both pass and DMARC can still fail.
DMARC requires alignment, meaning the domain in your visible From address has to match the domain that SPF or DKIM authenticated. If your From address says yourbusiness.com but SPF and DKIM authenticate the mail as the sending service’s domain, alignment fails, and DMARC fails with it.
If mail keeps deferring or bouncing while your DNS records look correct, check alignment first. Your mail provider’s documentation will have a domain authentication step that fixes exactly this, usually by adding a subdomain CNAME so the service signs as you.
Useful error codes if you can see the bounce message:
| Code | Meaning | What to fix |
|---|---|---|
| 421-4.7.26 | Temporary deferral, unauthenticated | Set up SPF and DKIM |
| 421-4.7.32 | Temporary deferral, no DMARC alignment | Fix domain alignment |
| 550-5.7.26 | Permanent rejection, unauthenticated | Same as above, now urgent |
The distinction matters: 4xx codes are temporary and may retry, 5xx codes are permanent and your mail is simply gone.
Step 5: Turn on email logging
Do this even after everything works, because it is the difference between knowing and guessing next time.
Most SMTP plugins offer logging that records every email WordPress attempted, whether the server accepted it, and any error it returned. When a customer says they never received a confirmation, the log tells you in seconds whether WordPress sent it, when, and to which address. Without logs, you are testing blindly.
Logging also turns mail into something you can monitor rather than something you discover. Our WordPress care plans treat failed sends as an alert, which is how most silent email failures surface before a customer mentions one.
If it is still failing: send the problem to the right layer
Email involves four layers, and only the owner of a layer can fix it. Escalating to the wrong one wastes days.
| Layer | Owner | Examples of what it breaks |
|---|---|---|
| The trigger | Your form or plugin | Disabled notification, wrong recipient, broken plugin |
| WordPress mail | Your site | Another plugin intercepting wp_mail, no SMTP configured |
| The connection | Your host | Blocked ports, required internal relay, firewall rules |
| Delivery | Your mail provider and DNS | Missing SPF/DKIM/DMARC, alignment, IP reputation |
Your host cannot fix a disabled form notification. A form plugin’s support team cannot unblock an SMTP port. Nobody at your mail provider can correct a WooCommerce order trigger. Identify the layer from the tests in Step 1, then contact that owner with specifics.
Other causes worth checking
A short list of things that produce the same symptom.
Causes inside your site
A plugin conflict. Another plugin can intercept wp_mail() and break it, particularly security and optimisation plugins. Take a backup first, then deactivate everything except your SMTP plugin and test, reactivating one at a time. The same method isolates other WordPress errors.
Credentials changed. If you updated a mailbox password, your SMTP plugin is still using the old one. It fails silently.
Form spam filters. If you recently tightened contact form spam protection, check that the filter is not catching and discarding legitimate submissions before an email is ever generated. Send blocked submissions to a spam folder you can review rather than deleting them outright.
Causes outside your site
A recent migration. Email breaking right after a host move is common, because the mail configuration did not travel with the files. If you moved hosts recently, reconfigure SMTP and re-check that your DNS records point at the right place.
Shared IP reputation. On shared hosting your server shares its outgoing IP with strangers. If one of them earns a spam flag, filters can quietly swallow mail from every account on that IP. A dedicated sending service removes you from that pool entirely.
A compromised site. Attackers who get in often use a site to send spam, which destroys the domain’s sending reputation. If email problems appeared alongside other odd behaviour, check for signs of a compromise first, and clean the site properly with our WordPress malware removal guide before blaming the mail setup.
Key takeaways
WordPress email fails silently because PHP’s mail() function carries no authentication and many hosts block it, and because a form’s success message proves nothing about delivery. Before changing anything, work out which of three problems you have: nothing arriving, arriving in spam, or only some notifications failing, because each has a different fix. Route mail through authenticated SMTP with a plugin, use port 587 with TLS, and move to an API-based mailer if your host blocks outbound SMTP entirely.
Set a real From address on your own domain, then add SPF, DKIM and DMARC, which are effectively mandatory in 2026 since providers now reject unauthenticated mail outright rather than filtering it. If records look right but mail still fails, check DMARC alignment. Turn on email logging so the next incident takes minutes instead of days. And if your store takes card payments, treat DMARC as a compliance requirement rather than an optimisation.
Frequently Asked Questions
Why is WordPress not sending emails?
WordPress uses PHP’s mail() function by default, which carries no authentication, and many hosts block or restrict it. Messages either never leave the server, or the receiving server rejects them on arrival. Routing mail through authenticated SMTP with a plugin, plus SPF, DKIM and DMARC records, fixes it in most cases.
How do I set up SMTP in WordPress?
Install an SMTP plugin such as WP Mail SMTP, choose a mailer (your host’s mailbox, Gmail, Brevo, Mailgun or SendGrid), and enter the host, port and credentials it provides. Use port 587 with TLS, set a real From address on your domain, then send a test email to confirm.
Why is my contact form not sending emails?
Either WordPress cannot send mail at all, or the form’s own notification points somewhere wrong. Check whether other WordPress emails, like a password reset, arrive. If they do, your mail works and the problem sits in the form’s notification settings, recipient address, or a spam filter discarding submissions.
Do I need SPF, DKIM and DMARC for a small site?
Effectively yes. The formal bulk sender rules apply above 5,000 emails a day, but Google, Yahoo and Microsoft recommend authentication for all senders, and providers now reject unauthenticated mail rather than filtering it. A small business sending a few enquiry notifications daily still needs the records to reach inboxes reliably.
Why do my WordPress emails go to spam instead of not sending?
That is a trust problem rather than a sending problem. The mail leaves successfully but fails authentication checks or carries a poor sender reputation. Add SPF, DKIM and DMARC, use a real From address on your sending domain, and consider a dedicated sending service rather than shared hosting mail.
My host blocks SMTP ports. What now?
Use an API-based mailer instead. Services such as Brevo, Mailgun and SendGrid connect over an API key rather than an SMTP port, which bypasses the block entirely. WP Engine, Kinsta and Flywheel block outbound SMTP by design, so an API connection is the standard approach on those platforms.
Want someone else to own the mail layer?
Broken email rarely announces itself, and it usually surfaces when a customer asks why nobody replied. Survyc is an AI-first digital agency, and we set up authenticated sending, DNS records and logging as part of the maintenance work we run white label for agencies. Email info@survyc.com or get in touch and tell us what your site is doing.
