WooCommerce Order Emails Going to Spam? Fix SPF, DKIM and DMARC

“Hi, I placed an order but never got a confirmation. Did it go through?”

If you’ve had this email once, you’ve probably had it twenty times without knowing. Most customers don’t write. They just assume your store is unreliable, and some ask their bank to reverse the payment.

The cause is almost always the same: your store’s emails aren’t proving they’re really from you, so Gmail, Outlook and Yahoo treat them as suspicious.

Why this got worse recently

Since 2024, Google and Yahoo have required senders to authenticate their email properly. Messages that don’t pass checks get sent to spam or rejected outright. Many WooCommerce stores were never set up for this, because by default WordPress sends mail straight from the web server, which looks exactly like a spammer.

The 3 records that fix it (in plain English)

Think of them as ID checks at the door:

• SPF: a list of servers allowed to send email for your domain. “Only these servers can send as mystore.com.”
• DKIM: a digital signature on every email, proving it wasn’t changed on the way.
• DMARC: your instructions to Gmail and others: “If an email claims to be from me but fails the checks, here’s what to do with it.” It also sends you reports.

All three are small text records in your domain’s DNS settings (where your domain is managed: Cloudflare, Namecheap, GoDaddy, or your host).

Step 1: Stop sending from your web server

This is the most important step. Use a proper email sending service with an SMTP plugin:

• Your existing email provider, like Google Workspace or Microsoft 365, for small stores with few orders.
• A transactional email service (Brevo, Postmark, Amazon SES, Mailgun) for stores with more volume. Many have free tiers.

Install an SMTP plugin (WP Mail SMTP, FluentSMTP or similar) and connect it. Now your store’s emails go through a trusted sender instead of the server.

Step 2: Add SPF

Your email service tells you exactly what to add. It looks like this:

v=spf1 include:_spf.google.com include:spf.brevo.com ~all

Important: you can only have one SPF record. If you use two services, combine them into one line. Two separate SPF records is a common mistake that breaks everything.

Step 3: Add DKIM

Your sending service gives you one or more DNS records (often called something like “brevo._domainkey”). Copy them exactly into your DNS. Then click “verify” in the service.

Step 4: Add DMARC

Start gentle, with monitoring only:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

After a few weeks of reports showing everything passes, you can tighten it to p=quarantine. Don’t jump straight to strict mode or you might block your own mail.

Step 5: Test it

• Place a test order and send the confirmation to a Gmail address.
• In Gmail, open the email → three dots → Show original. You want PASS next to SPF, DKIM and DMARC.
• Free tools like mail-tester.com give you a score out of 10.

Other reasons WooCommerce emails go missing

• The “From” address doesn’t match your domain (for example, sending as yourstore@gmail.com from your site).
• Email notifications are turned off in WooCommerce → Settings → Emails.
• A plugin conflict stops emails from being sent at all. Check WooCommerce → Status → Logs.
• Your server’s IP is on a spam blacklist because of other sites on shared hosting.

Why it’s worth fixing this week

Order emails aren’t a nice extra. They’re proof of purchase, delivery updates, password resets and review requests. When they fail, you get more support emails, more “where’s my order?” messages, more chargebacks and fewer repeat customers.

Want it done for you?

This is a classic Fix Sprint: I set up the sending service, SPF, DKIM and DMARC, test it end to end and send you proof, for a fixed price, usually within 48 hours.

Not sure if your domain is set up? The free Website Health Checker is a good first step, or send me your store’s URL and I’ll check your email records for free.