Your Emails Are Going to Spam and an SMTP Plugin Won’t Fix It

You installed WP Mail SMTP. You pointed it at Google Workspace or Brevo. The test email arrived, so you ticked it off. Three weeks later a client says they never got your invoice, and you find a fortnight of contact form notifications sitting in junk.

Here’s the thing people miss: an SMTP plugin fixes whether your email sends. It does nothing about whether anyone trusts it. Those are two different problems, and only one of them lives in WordPress.

Sending and trust are separate problems

When your site sends mail through PHP’s built-in function, it hands the message to whatever mail system your web host happens to run. Most hosts either block that outright or configure it badly. An SMTP plugin routes around the whole mess by sending through a real mail provider instead. Genuinely worth doing — it’s step one, and I’ve written the step-by-step for contact forms separately.

But Gmail and Outlook aren’t asking “did this send correctly”. They’re asking “can I prove this came from who it claims to come from, and do I have any reason to trust that domain”. The answer to both lives in your DNS records, not in your WordPress admin. Which is why you can have a perfectly configured SMTP plugin and still sit in spam indefinitely.

The three records, in plain English

SPF is a list of who’s allowed to send email using your domain. It’s one DNS record naming every service you send through — your mail provider, your CRM, your invoicing system, your site. A receiving server looks up the list and checks whether the server that just handed it a message is on it.

DKIM is a signature. Your mail provider signs each outgoing message with a private key, and publishes the matching public key in your DNS. The receiver verifies the signature and knows the message is genuinely yours and wasn’t altered in transit.

DMARC is the policy on top. It says what should happen when SPF and DKIM fail — nothing, quarantine, or reject — and, more usefully, it asks receiving servers to send you reports about mail claiming to be from your domain. Most businesses set up the first two, skip the third, and then have no idea anything is broken.

The part almost nobody checks: alignment

This is where most “but I set all that up” conversations end.

SPF and DKIM can both pass while DMARC still fails, because DMARC doesn’t just want a pass. It wants the domain that passed to match the domain in the From header your recipient actually sees.

Say your invoicing system sends on your behalf. The message passes SPF — but it passes for invoicing-provider.com, because that’s whose servers sent it. Your recipient sees accounts@yourbusiness.com.au. Those two domains don’t match, so the message is unaligned. SPF passed. DMARC failed. Into junk it goes.

Fixing it means authenticating each service for your own domain — usually by adding that provider’s DKIM records to your DNS and configuring a custom sending domain in their dashboard, rather than accepting their default. Every service you send through needs this done separately. It’s the single most common cause of mail that looks correctly set up and still doesn’t land.

Google and Yahoo moved the floor in 2024

From February 2024, Google and Yahoo started requiring bulk senders to authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe on marketing mail, and keep spam complaints under 0.3%. The threshold for “bulk” is 5,000 messages a day, so most small businesses are technically under it.

Don’t take much comfort from that. The requirements told every mailbox provider what good looks like, and unauthenticated mail from small senders is now treated with correspondingly more suspicion. The floor moved for everyone; it’s only formally enforced at the top.

Stop mixing marketing and transactional mail

If your newsletter and your password resets leave from the same domain, they share a reputation. One campaign to a stale list, a spike in complaints, and suddenly nobody’s receiving your invoices either.

Split them. Marketing from news.yourbusiness.com.au, transactional from mail.yourbusiness.com.au, each authenticated separately. A bad campaign then costs you a campaign rather than your business mail. This is standard practice at any scale and almost never done on small business sites.

The order to fix it in

Work through this in sequence. Doing it out of order is how people break their own mail.

1. Inventory every sender. Your web host, mail provider, CRM, invoicing tool, booking system, e-commerce platform, mailing list. Nearly everyone finds at least one they’d forgotten.
2. Route WordPress through a real SMTP relay. This is where an SMTP plugin does its job.
3. Publish one SPF record covering every sender from step one. One record, not several — multiple SPF records is itself a failure condition.
4. Set up DKIM for each service individually, using your own domain rather than the provider’s default.
5. Publish DMARC at p=none. This changes nothing about delivery. It just turns the reports on.
6. Read the reports for a few weeks. They’ll show you exactly which legitimate systems are failing alignment. Fix those.
7. Only then tighten to quarantine, and later reject.

Skipping to step seven is a genuinely bad day. You’ll stop the spoofing and also stop the booking system you forgot about.

When it isn’t DNS at all

A few causes that look identical from the inbox but aren’t authentication:

• The From address doesn’t exist. Plenty of providers reject mail claiming to come from a mailbox that isn’t real. noreply@ addresses that were never created are a classic.
• Shared host IP reputation. On cheap shared hosting you inherit the sending reputation of everyone else on that IP. This is one of several reasons that hosting is worth paying for.
• The form plugin overrides your sender settings. Some form plugins set their own From address regardless of what the SMTP plugin says, which quietly breaks alignment you’d correctly configured.
• Content triggers. Rare, but a form that emails whatever a visitor typed will occasionally mail spam to you, from you.

The part that should worry you

Failed email is silent. There’s no bounce, no error, no notification. Someone fills in your contact form, sees “message sent”, and waits for a reply you never knew to send. You only find out when a client mentions it in passing, months of enquiries later.

If you’re not certain your mail is landing, check it rather than assume. And if the DNS side is beyond where you want to go, that’s what the WordPress email deliverability fix service is for — full audit of mail flow and authentication, remediation, and inbox placement testing so you know it works rather than hope.