WP Mail SMTP: get your site's e-mail delivered

Why WordPress mail goes missing

Out of the box WordPress hands every message (contact forms, password resets, order notices) to the web server with a made-up sender such as wordpress@yourdomain.com. Gmail, Outlook and Yahoo now check every message for proof that it really came from the domain in the From address. Mail that cannot prove it goes to spam or is rejected, and you never find out.

SPF and DMARC in plain English

• SPF is a line in your domain's DNS that lists the servers allowed to send mail for your domain.
• DKIM is a digital signature your mail server adds to each message.
• DMARC tells receivers what to do when a message fails. To pass, either SPF or DKIM must pass and match the domain in the From address. That matching is called alignment.

SPF does not check the From address you see. It checks the hidden envelope sender, also called the Return-Path. If WordPress sends From: you@yourdomain.com but the Return-Path is apache@server123.hostname.net, SPF can pass for the host's domain and still fail alignment for yours. Two WP Mail SMTP settings, Force From Email and Return Path, make all three addresses the same.

WP Mail SMTP > Settings

Setting	Our choice	Why
From Email	A real mailbox on your own domain, for example website@yourdomain.com	Must be on the domain your SPF and DKIM records cover, and must exist so replies and bounces have somewhere to go.
Force From Email	On	Contact form and shop plugins often set their own From address. Forcing it makes every message use the address your DNS vouches for. Put the visitor's address in the form's Reply-To instead, so you can still just click Reply.
From Name	Your business name	What people see in their inbox.
Force From Name	On	Keeps the name the same for every plugin.
Return Path	On	Sets the envelope sender to your From Email. This is the setting that makes SPF line up with your domain, and bounce messages come back to you instead of disappearing.
Mailer	Other SMTP (or your mail provider, see below)	Sends through a real mailbox with a username and password, exactly like your phone does.

Other SMTP settings

Setting	Value
SMTP Host	Your mail server, for example mail.yourdomain.com (your host will tell you)
Encryption	TLS
SMTP Port	587
Auto TLS	On
Authentication	On
SMTP Username	The full address of the From Email mailbox
SMTP Password	That mailbox's password (better: put it in wp-config.php, below)

Choosing the mailer

• Your mail is hosted with your web host (the same company): use Other SMTP with that mail server.
• Your mail is on Google Workspace or Microsoft 365: choose the Google / Gmail or Microsoft 365 / Outlook mailer and follow its connection steps. Your SPF record must already include Google or Microsoft.
• A shop or site that sends thousands of messages: a transactional service (Brevo, SendLayer, Mailgun, Postmark and others) with its own DNS records. With these API mailers the provider sets the Return-Path for you, so follow their DNS instructions exactly.

Keep the password out of the database

WP Mail SMTP can read its settings from wp-config.php, which keeps the mailbox password out of the database and out of database backups. Add these lines above "That's all, stop editing!", with your own values:

define( 'WPMS_ON', true );
define( 'WPMS_MAILER', 'smtp' );
define( 'WPMS_SMTP_HOST', 'mail.yourdomain.com' );
define( 'WPMS_SMTP_PORT', 587 );
define( 'WPMS_SSL', 'tls' );
define( 'WPMS_SMTP_AUTOTLS', true );
define( 'WPMS_SMTP_AUTH', true );
define( 'WPMS_SMTP_USER', 'website@yourdomain.com' );
define( 'WPMS_SMTP_PASS', 'the-mailbox-password' );

The matching fields in the settings screen turn grey to show they come from the file.

Test it properly

1. Go to WP Mail SMTP > Tools > Email Test and send a test to a Gmail address.
2. In Gmail, open the message, click the three dots and choose Show original.
3. You want three passes at the top: SPF: PASS, DKIM: PASS and DMARC: PASS, each mentioning your domain.
4. Then send a real message through your contact form and check that it arrives, and that Reply goes to the visitor.
5. If something fails, Tools > Debug Events shows the error from the mail server.

Your SPF record

Your domain should have exactly one SPF record, a TXT record that starts with v=spf1. A typical one looks like:

v=spf1 mx a include:_spf.yourmailprovider.com ~all

• List every service that sends mail as your domain (your host, Google or Microsoft, your newsletter tool).
• Stay under 10 DNS lookups in total. Each include, a and mx counts, and a record over the limit fails everywhere.
• Add a DMARC record (_dmarc.yourdomain.com) starting with v=DMARC1; p=none; and a reporting address, then tighten it once reports show everything passes.