WooCommerce emails going to spam: how do you fix them?

Key takeaways

• WooCommerce does not send mail itself. It calls WordPress’s wp_mail() function, which uses the web server’s mail function unless a plugin changes that (WordPress wp_mail() reference).
• Order emails show your store’s domain in the From address, but they often leave from a server your domain has never authorized. Receivers see a message that fails DMARC.
• The fix has three parts: send through a server you can authorize, add that real sender to SPF and turn on DKIM for your domain, and keep the From address on your own domain.
• Test every change with AdminKit’s free SPF check, DKIM check and DMARC check, then confirm with a real test order.

How does WooCommerce actually send email?

WooCommerce builds the order email, then hands it to WordPress. WooCommerce’s email troubleshooting documentation says it sends mail with wp_mail(), a core WordPress function. So most delivery problems are not in WooCommerce. They are in the path the mail takes after that.

The WordPress wp_mail() reference shows the defaults:

• wp_mail() uses the PHPMailer library and, unless something changes it, the PHP mail() function. That passes the message to the mail program on your web server.
• The default From address is wordpress@ followed by your site’s domain. WooCommerce sets its own From name and address for its emails, from WooCommerce > Settings > Emails.
• The envelope sender (the bounce address) is not set from the From address, so it is whatever the server’s mail program uses. On shared hosting this is often an address at the server’s own hostname.

Plugins can change all of this. An SMTP or email-service plugin hooks into wp_mail() and sends the message through an outside provider instead of the web server. The function and its filters (wp_mail_from, phpmailer_init) are documented on the same reference page.

Why do the receivers put it in spam?

A receiving mail server sees a message whose From address is orders@yourstore.example. It then checks whether your domain vouches for it:

• SPF (Sender Policy Framework, RFC 7208) checks whether the sending server’s IP address is listed in the SPF record of the envelope sender’s domain.
• DKIM (DomainKeys Identified Mail, RFC 6376) checks a cryptographic signature against a public key published in DNS by the signing domain (the d= value).
• DMARC (RFC 9989) passes only if SPF or DKIM passes for a domain that matches the From domain. This match is called alignment.

A default WooCommerce setup on a web host often fails all three for your domain. The web server’s IP is not in your SPF record. The envelope sender is the host’s domain, so even a passing SPF result is for the wrong domain. And the server does not sign with DKIM for your domain. The From address says your store, but nothing in DNS backs that up.

Google’s email sender guidelines ask everyone who sends to Gmail to set up SPF or DKIM, and bulk senders to set up DMARC with an aligned From domain. Mail that fails these checks is much more likely to be filtered or rejected. If your domain already publishes DMARC at p=quarantine or p=reject, receivers are asked to send failing order emails to spam or refuse them outright.

The difference between the envelope sender and the header From is the key idea here. Customers see the From address. SPF checks the envelope sender, shown as the Return-Path in the delivered message.

Which sending setup should your store use?

There are three common ways to send WooCommerce mail. All of them can work. What matters is whether you can authorize the real sender for your domain.

Sending path	Who really delivers the mail	SPF for your domain	DKIM for your domain	Typical result
Default wp_mail() on shared hosting	The web server’s mail program	Only if your host gives you an include or IP to add	Only if the host offers DKIM for your domain	Often fails DMARC; most common cause of spam placement
Host’s mail service with your domain set up	The host’s outgoing mail servers	The include the host documents	Usually, once you publish the host’s DKIM record	Can pass if both records are published
SMTP or email-service plugin	The provider the plugin connects to	The include the provider documents	Yes, after you publish the provider’s DKIM records	Passes when the provider is set up for your domain

There is no single right vendor. Your mailbox provider, your host and many dedicated email services all offer SMTP sending. Pick one that documents SPF and DKIM for a custom domain, and that you can test.

How do you fix it, step by step?

Step 1: Set the From address to your own domain

In WooCommerce > Settings > Emails, set the “From” address to an address at your store’s domain, such as orders@yourstore.example. WooCommerce’s documentation warns that a public mailbox address, such as a Gmail or Yahoo address, in this field is likely to land mail in spam or get it blocked. If you use an SMTP plugin, make sure the plugin’s From setting uses the same domain, or set it to not override WooCommerce’s address.

Step 2: Decide who really sends the mail

Choose one of the paths in the table above and make it the only path. Do not leave some mail on the web server and some on a plugin. If you install an SMTP plugin, send a test from the plugin’s own test screen first.

Step 3: Add the real sender to your one SPF record

Find the SPF include or IP address in your host’s or provider’s setup instructions. There is no WooCommerce include, because WooCommerce never delivers mail itself. Then merge it into your existing record. A domain must publish only one SPF record: RFC 7208 §3.2 says a receiver that finds two returns a permerror, and SPF fails for all your mail.

v=spf1 include:_spf.mailbox-provider.example include:spf.smtp-provider.example ~all

The domains above are placeholders. Each include: uses at least one of the 10 DNS lookups RFC 7208 §4.6.4 allows. If you are close to the limit, read fixing SPF “too many DNS lookups”.

If your provider uses a custom bounce (return-path) domain, set it up. It lets SPF pass for a subdomain of your own domain, so SPF aligns for DMARC too.

Step 4: Turn on DKIM for your domain

Your host or provider gives you DKIM records, usually a TXT or CNAME record at <selector>._domainkey.yourstore.example. The selector is a short name that lets several senders publish keys side by side. Publish the record, then switch on signing in the provider’s settings. DKIM is the more reliable of the two for DMARC, because the signature travels inside the message.

Step 5: Publish or check DMARC

If your domain has no DMARC record yet, start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourstore.example

p=none does not change delivery. It asks receivers to send you reports that show which servers send as your domain and whether they pass. Move to quarantine and reject only after every legitimate sender passes. Email authentication for online stores walks through that rollout for all of a store’s senders, not only WooCommerce.

How do you test that the fix worked?

Test both the DNS records and a real message:

1. Run the SPF check on your store’s domain. Confirm there is exactly one SPF record, that it includes your real sender, and that the lookup count is under 10.
2. Run the DKIM check with your domain and the selector from your provider. Confirm the key is published and valid.
3. Run the DMARC check to see your current policy and report address.
4. Place a test order to a mailbox at a large provider. Open the raw message headers and paste them into the email header analyzer.
5. In the Authentication-Results line, look for dmarc=pass. Then check that the DKIM header.d= or the SPF smtp.mailfrom= domain matches your From domain. How to read email headers explains each field.

Repeat the test for the other WooCommerce emails customers rely on, such as password resets and refund notices, and for any other plugin that sends mail from your site.

What else can still send WooCommerce mail to spam?

Symptom	Likely cause	What to check
spf=pass but dmarc=fail	SPF passed for the host’s or provider’s bounce domain, not yours	Set up DKIM for your domain or a custom return-path domain
dkim=pass but dmarc=fail	The provider signs with its own d= domain	Publish the provider’s DKIM records for your domain
spf=permerror	Two SPF records, or more than 10 lookups	Merge into one record; reduce includes
Some emails pass, others fail	Another plugin still sends through the web server	Send every plugin through the same path
All checks pass but mail still goes to spam	Sending IP reputation or content	Run a blacklist check on the sending IP

Authentication does not guarantee the inbox. Receivers also weigh reputation, complaints and content. But it is the part you fully control, and it is usually the reason a new store’s order emails go to spam.

Check your store’s SPF record now: it is free, reads only public DNS, needs no account and sends no mail. This guide is part of AdminKit’s email authentication cluster.

This guide is general information, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.