A missing contact-form inquiry can mean a missed customer. A password-reset message that never arrives can lock out a team member. And when WooCommerce order receipts, refund notices or site-error alerts disappear into spam, the problem can quickly become operational.
One important distinction: WordPress sending an email is not the same as a recipient receiving it. A message can be triggered successfully by a form or store, then fail because of its sending method, domain authentication, DNS configuration or filtering at the receiving mailbox.
This checklist helps you identify where to look before making changes. It is designed for business owners, nonprofit administrators, ecommerce teams, designers and agencies managing WordPress sites.
First, identify which kind of email is failing
“Email is broken” is usually too broad to troubleshoot. Your organization may use several separate mail streams, often managed by different providers:
- One-to-one business email: messages sent by staff from their normal mailbox.
- WordPress transactional email: contact-form notifications, password resets, comment notices and administrator alerts.
- Ecommerce email: WooCommerce order confirmations, completed-order messages, invoices, refunds and customer account notices.
- Marketing or newsletter email: campaigns sent through a dedicated email platform.
- Forwarded email: mail sent to one address and automatically forwarded elsewhere.
These streams may not share the same sender, infrastructure or DNS settings. A newsletter may be working while WordPress order email fails. Staff mailbox email may arrive normally while contact-form notifications go to junk. Start by naming the exact message that is missing.
The three layers behind WordPress email delivery
1. WordPress and the application
First ask whether the site actually triggered the message. Did the form show a successful submission? Did WooCommerce record the order? Did WordPress generate the password-reset request? A form confirmation on screen does not always prove that the notification was delivered.
Also confirm that the WordPress administration and recovery email belongs to the organization, is monitored and is accessible. This matters during routine maintenance as well as troubleshooting. After WordPress changes, include email tests alongside the checks in our guide, How to Update WordPress Safely: A Security Checklist for Canadian Business Websites.
2. The sending method
WordPress can use a default server-based sending path, but that path may not be suitable or reliably configured for every site. WordPress documentation recommends checking hosting and email configuration and considering an authenticated SMTP or transactional-email service when delivery is unreliable.
An authenticated sending connection gives the site a defined route for sending mail. It does not guarantee inbox placement, but it can make the source of website mail clearer and more manageable than an unverified default path.
3. Domain and DNS authentication
Receiving mail systems evaluate signals that help them decide how to handle incoming mail. Three key DNS-based controls are SPF, DKIM and DMARC:
- SPF lists the services permitted to send mail for a domain.
- DKIM adds a cryptographic signature to a message so receiving systems can validate it.
- DMARC uses SPF and/or DKIM alignment with the visible From domain, along with a published policy, to guide the handling of mail that fails authentication.
These controls are not universal inbox-placement switches. Recipient reputation, message content, engagement, sending infrastructure and other factors can still affect delivery. However, they are important foundations for legitimate domain email.
WordPress email troubleshooting checklist
- Confirm the recipient address and check junk or spam. Check the intended mailbox carefully, including spam, junk, quarantine and any mailbox rules. For a contact form, confirm the notification address configured in the form is current.
- Send a controlled test from the site. Submit a test form or trigger a password reset to an address you can inspect. Record what happened, the time and any visible error message. Do not share SMTP passwords, API keys or other credentials in support tickets.
- Verify the WordPress administration and recovery email. Make sure it is controlled by the organization rather than a departed employee, former agency or inaccessible personal account.
- Identify the actual sending service and visible From address. Determine whether the site sends through the web server, an authenticated SMTP connection or a transactional-mail service. Then note the visible From address shown to recipients. These details are essential when reviewing authentication.
- Inventory every legitimate sender using the domain. Include the mailbox provider, WordPress or SMTP service, ecommerce platform, CRM, booking or form tool, newsletter platform and any agency-managed tool. Missing even one source can create delivery trouble later.
- Review SPF, DKIM and DMARC in the authoritative DNS zone. Confirm you are looking at the DNS provider currently authoritative for the domain. This is especially important after a domain transfer, hosting move or nameserver change.
- Check domain alignment for mail sent to Gmail recipients. For messages sent directly to Gmail, review whether the visible From domain aligns with SPF or DKIM as appropriate for the sending setup.
- Check available logs and delivery reports. Look at WordPress, form-plugin, ecommerce, SMTP or transactional-service logs where available. When asking for help, provide the sending time, recipient domain, visible error and affected message type—not only “email is broken.”
Why authentication matters now
Gmail’s sender guidance says all senders to Gmail need SPF or DKIM. Bulk senders have additional requirements, including SPF, DKIM and DMARC. Google recommends that all domains set up SPF, DKIM and DMARC, and notes that messages failing requirements may be rejected or sent to spam.
Google’s sender FAQ says enforcement for non-compliant traffic began ramping up in November 2025. This is an ongoing deliverability reality, not a reason to make rushed DNS changes.
Yahoo similarly says senders need SPF or DKIM at minimum. Its bulk-sender guidance includes SPF, DKIM, a DMARC policy of at least p=none, and From-domain alignment with SPF or DKIM. Yahoo also publishes a spam-rate threshold for senders, reinforcing that authentication is only one part of responsible sending.
For current details, review Gmail’s email sender guidelines and Yahoo’s sender best practices.
Common mistakes that break delivery
- Publishing multiple SPF TXT records. A domain should not have several separate SPF policies. SPF needs to represent all legitimate senders in a properly managed record.
- Adding a new platform without updating authentication. A new booking system, CRM, newsletter tool or transactional sender may need DNS records or domain verification before it can send appropriately.
- Using a From address the service cannot authenticate. A tool may allow a From address to be entered, but that does not mean it can authenticate mail for that domain.
- Turning on strict DMARC enforcement too early. Moving to
quarantineorrejectbefore legitimate senders are found and validated can interfere with wanted mail. - Treating newsletters and WooCommerce notices as one stream. They can be sent by different systems and need separate investigation.
- Editing DNS at the wrong provider. The company that registered the domain, hosts the website or provides email may not be the provider currently serving authoritative DNS.
A safer DMARC rollout path
DMARC can be valuable, but it should be treated as an operational project rather than a one-line DNS change. A staged approach helps avoid disrupting legitimate mail:
- Inventory every sender that uses the domain.
- Validate SPF and DKIM for each legitimate sending stream and check alignment with the visible From domain.
- Begin with monitoring using a DMARC policy of
p=none. - Review reports and mail streams to identify authorised sources, unknown sources and configuration gaps.
- Consider enforcement carefully only after the organization understands its sending sources and the impact of stronger policies.
This staged path is consistent with CISA guidance on implementing DMARC. It is particularly important for organizations with older websites, multiple vendors or long-running agency arrangements.
For WordPress and WooCommerce: test after every meaningful change
Use an authenticated sending method for WordPress where appropriate, then test the messages your business actually depends on. After changes to WordPress, plugins, a form, WooCommerce settings, SMTP configuration, DNS or hosting, test:
- Contact-form notifications
- Password-reset messages
- New-order emails
- Refund and order-status emails
- Customer account notices
- Critical administrator and site-error alerts
Use test recipients at more than one mailbox provider when practical, and record the results. A successful test is useful evidence, but it is not a permanent guarantee against future filtering or delivery changes.
Owner’s checklist: know who controls what
Whether you manage the site yourself or work with an agency, keep an up-to-date record of:
- Who owns the domain registration
- Where authoritative DNS is managed
- Where business mailbox email is hosted
- What service sends WordPress and WooCommerce email
- What service sends marketing email
- Who can update DNS records and email-sending settings
- Who has access to the WordPress administration and recovery email
This documentation is especially important during a designer or agency transition. Our article Retiring From Web Design? A Practical Plan for Handing Off Your WordPress Hosting Clients covers why clear ownership of domains, DNS, email services and credentials matters in a proper handoff.
Plan email delivery as part of a WordPress move
If you are moving a WordPress site—or inheriting one from a designer—include domain, DNS and email delivery in the migration plan. Advantage Hosting offers free website migration; contact the team before changing nameservers or mail-related DNS records so the website move does not unintentionally interrupt business email.
Where a broader hosting review is part of that planning, see Why Canadian Businesses Choose Canadian Web Hosting. Keeping your data in Canada and choosing Canadian servers can be an important hosting consideration, but inbox placement still depends on the website’s sending setup, domain authentication and recipient-side filtering.
