How to Fix WooCommerce Emails Going to Spam

WooCommerce emails land in spam for a short list of reasons, and most of them come back to authentication. WordPress sends mail through PHP’s mail() function by default, which hands your order confirmation to whatever mail server your host happens to be running. Nothing signs the message and nothing authorizes it, which used to be survivable and no longer is. Gmail and Yahoo tightened their sender rules in early 2024. Microsoft followed in May 2025 and now rejects non-compliant bulk mail outright rather than filing it into junk.

Confirm the Emails Are Actually Leaving Your Server

Before changing anything, work out whether you have a delivery problem or a sending problem.

Start inside WooCommerce. Go to WooCommerce → Settings → Emails, where every notification your store sends is listed. From WooCommerce 9.8 onward you’ll find an Email Preview section with a “Send a test email” option. If that section isn’t showing, switch it on under WooCommerce → Settings → Advanced → Features. Plenty of guides confuse these two screens. Advanced → Features is only the toggle, and the actual test send lives under Emails.

Send a test to an address you control on Gmail, then another to an Outlook or Hotmail address. If nothing arrives at either, your host is probably blocking outbound mail on port 25 or the PHP mail function is disabled entirely. If both land in spam, your domain and sending server aren’t authenticated. And if one provider takes it while the other doesn’t, you’re looking at a reputation problem specific to that provider rather than a broken setup.

Then run a message through a deliverability checker. Mail-tester.com scores a single email out of 10 and names the exact authentication check that failed. MXToolbox tells you whether your sending IP sits on a blacklist. If you send any real volume, register the domain in Google Postmaster Tools, which Google rebuilt in October 2025 around a binary pass/fail Compliance Status instead of the old reputation grades.

Why WordPress Mail Looks Suspicious to Gmail

The message leaves from a shared server IP that isn’t listed in your domain’s SPF record, and nothing signs it with DKIM. So Gmail sees mail claiming to come from yourstore.com, sent by a machine your domain never authorized, carrying no cryptographic signature. There’s no way to verify you sent it. Junk folder.

It gets worse on shared hosting, where you inherit the reputation of every other site on that IP. One spammy neighbour and your order confirmations pay for it. That’s part of why stores doing real revenue tend to move onto hosting built for WooCommerce, though changing hosts on its own won’t solve authentication.

Pick Your Email Service First

The SPF include and DKIM keys you’ll need come from whichever sending service you choose, which is why picking one comes before installing any plugin.

For a typical store sending order confirmations and password resets, the free tiers cover it comfortably. A shop doing 200 orders a month sends maybe 800 emails.

If there’s any chance you’ll run a second storefront on another platform later, pick a service that covers both. The providers named in roundups of the best email marketing for Shopify overlap almost entirely with what works on WooCommerce, so the same account carries across. Handy if you’re still weighing Shopify against WordPress for a future project, because migrating a storefront is painful enough without rebuilding your sending infrastructure alongside it.

Route WooCommerce Through It With an SMTP Plugin

With a provider picked, install a plugin that swaps PHP mail() for an authenticated SMTP connection. WP Mail SMTP is the most widely installed option and ships a setup wizard covering most major providers. FluentSMTP is completely free with no premium upsell and supports routing rules across multiple providers, which is useful if you want marketing and transactional mail leaving through separate accounts. Post SMTP Mailer includes email logging and failure alerts in its free version. Easy WP SMTP is the lightest of the four if you only need a single connection.

Configure the plugin with the API key or SMTP credentials from your provider, set the from-address to a real mailbox on your own domain, then send another test. Don’t use a Gmail or Yahoo address as your from-address. Those domains publish strict DMARC policies and your mail gets rejected outright.

Add the DNS Records Your Provider Gives You

Your sending service hands you a set of records to publish at your DNS host. This is where most of the actual fix happens.

• SPF – a TXT record listing the servers allowed to send for your domain. Keep it to one SPF record and stay under the 10-lookup limit, or it fails silently
• DKIM – a TXT or CNAME record holding the public key your provider signs messages with
• DMARC – a TXT record at _dmarc.yourdomain.com telling receivers what to do when the other two fail. Start at p=none with an rua address you actually read, then tighten to quarantine once the reports look clean

Most DNS changes propagate within an hour, though anything up to 24 hours is normal depending on your previous TTL. Don’t judge the fix by a test you ran five minutes after hitting save.

Know Which Rules Apply to Your Store

The requirements shift depending on what you send and how much of it. Gmail and Yahoo classify any domain sending 5,000 or more messages a day to their consumer addresses as a bulk sender, and that classification sticks permanently once applied, even if volume drops later. Microsoft joined in May 2025 with the same 5,000-a-day threshold for Outlook.com and Hotmail.com, where non-compliant mail now gets a 550 5.7.515 rejection.

Spam complaint rate matters more than most store owners realize. Gmail wants you under 0.1% and treats 0.3% as a hard ceiling. That sounds generous until you run the arithmetic. Deliver 10,000 emails and it takes just 30 people hitting “report spam” to cross the line, and once you’re over, mitigation only returns after seven consecutive days back under 0.3%.

Worth knowing that the one-click unsubscribe requirement (RFC 8058) applies to marketing and promotional mail only. Google explicitly exempts transactional messages such as password resets and order confirmations, so if receipts are what’s going missing, unsubscribe headers aren’t your problem. But if you send a newsletter from the same domain, they absolutely are, because complaints against your marketing mail drag down the same reputation your transactional mail depends on.

Clean Up What’s Inside the Message

Filters read the message body once authentication passes. Subject lines that oversell and image-heavy templates with almost no text both push your score in the wrong direction, and link shorteners that mask the destination do the same. Keep a sensible text-to-image ratio and host images on your own domain instead of embedding large attachments.

Check the from-name and reply-to as well. Both should be real and monitored. Microsoft’s guidance is explicit that the reply-to address has to accept mail, and a no-reply address that bounces counts against you.

Keep WordPress and WooCommerce Patched

A compromised store becomes a spam relay, and once your domain has been used to blast phishing mail, no amount of SPF tuning brings the reputation back quickly. Attackers hunt for outdated plugins precisely because a hijacked site with an aged domain sends mail that already passes authentication.

Turn on automatic updates for WooCommerce and WordPress core, then audit any plugin you haven’t touched in a year. If the developer hasn’t shipped an update in two years, remove it.

In Short?

Confirm where the mail is failing, choose a sending service, connect it with an SMTP plugin, then publish the DNS records that service gives you. That covers the overwhelming majority of WooCommerce deliverability problems and it’s usually an afternoon of work.

What it won’t fix is a domain that’s already been burned. If your reputation is genuinely damaged, expect a few weeks of consistent low-complaint sending before inbox placement recovers, which is a good argument for starting now instead of after the next round of support tickets.