A customer fills in your contact form, places an order, or asks to reset their password, and the confirmation email never arrives. Or worse, it lands straight in their spam folder, and neither of you notices until it's too late. This very common WordPress problem almost always has the same root cause: SPF, DKIM and DMARC, three protections that are missing or misconfigured.

For a small business owner, these acronyms sound like technical jargon reserved for IT specialists. In reality, they directly determine whether your wordpress emails end up in spam, silently costing you sales and credibility without you ever realizing it.

SPF, DKIM and DMARC are three DNS records that prove to mailboxes that your emails are legitimate. Without them, or with them misconfigured, Gmail, Outlook and other providers flag your messages as suspicious and send them to spam, or block them outright.

Why WordPress has an email problem by design

By default, WordPress sends emails through PHP's mail() function, straight from the hosting server. The issue is that this server usually has no official authorization to send emails on behalf of your domain. As a result, mail providers treat these messages as suspicious by default, a behavior that has only gotten stricter since Google and Yahoo tightened their sender authentication requirements.

This is the number one reason WordPress emails never arrive, well ahead of any issue with the content or wording of the message.

SPF: authorizing who can send on your behalf

SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send emails for your domain. Without it, any server can theoretically impersonate your domain, and mailboxes know this: they are cautious by default.

In practice, an SPF record is a line of text added to your domain's DNS zone stating: "only these servers are allowed to send emails on my behalf." If both your web host and your email sending service (SMTP) aren't included in that list, part of your emails will automatically be flagged as suspicious.

DKIM: signing every email to prove authenticity

DKIM (DomainKeys Identified Mail) adds an invisible cryptographic signature to every email sent. The receiving mailbox checks this signature against a public key published in your DNS. If it matches, the email is authenticated as unaltered in transit and genuinely coming from your domain.

Without DKIM, an email can be intercepted or forged with nothing to indicate it to the recipient. With many mail providers, a missing DKIM signature alone is enough to push a message into spam.

DMARC: the policy that decides what to do when in doubt

DMARC (Domain-based Message Authentication) builds on SPF and DKIM to define a clear rule: what should happen if an email claims to come from your domain but fails these checks? Three options exist:

  • none: do nothing special, just monitor (recommended when starting out)
  • quarantine: send the suspicious message to spam
  • reject: block the message outright

DMARC also lets you receive regular reports on attempts to impersonate your domain, valuable information that few business owners ever check, even though it's free.

The right fix: route through an external SMTP service

The most reliable way to solve this problem for good isn't to tinker with DNS alone, but to hand off your email sending to a dedicated SMTP service like Brevo or Resend. These platforms are built for deliverability, automatically handle much of the SPF and DKIM compliance, and provide open-rate statistics that WordPress alone never gives you.

A plugin like WP Mail SMTP connects WordPress to this service in a few clicks, without touching the site's code. We walk through this setup in our guide configuring SMTP on WordPress with Brevo.

Checking that everything works correctly

Once SPF, DKIM and DMARC are in place, a few free tools let you verify the configuration: MXToolbox, Mail-Tester, or Google Workspace's security center if you use it. A good deliverability score confirms that your emails now land in the main inbox, no longer in spam or promotions.

When to call in a professional

Configuring SPF, DKIM and DMARC means editing your domain's DNS zone, an area where a mistake can cut off access to your existing business email, not just WordPress emails. If you're not comfortable managing DNS, if your domain already hosts professional email addresses (contact@, sales@), or if the problem persists after a first attempt, it's safer to hand this configuration to a professional who can check every record without breaking anything.

Frequently asked questions

Why do my WordPress emails arrive sometimes but not always? This is a classic sign of partial authentication: some mail providers apply stricter rules than others. Gmail may accept an email that Outlook rejects, depending on the SPF and DKIM setup in place.

Do I need SPF, DKIM and DMARC for a simple showcase site? Yes, as soon as the site sends automatic emails (contact form, notifications), even without an online store. A contact form whose replies end up in spam loses you leads without you ever knowing.

How long does setup take? The DNS change itself takes a few minutes, but full propagation can take up to 24 to 48 hours before every mail server worldwide recognizes the new configuration.

To go further on the reliability of your email exchanges, our article on receiving your WordPress emails via SMTP Brevo or Resend is a useful next read.

Your WordPress emails aren't reaching their destination? Relax by Yumea diagnoses and fixes your site's deliverability, as part of the Essentiel (35 EUR excl. VAT/month), Sérénité (65 EUR excl. VAT/month) or Priorité (95 EUR excl. VAT/month) plans. Request your free diagnosis at /en/relax/