Why do my website's emails go to spam?

Gmail, Yahoo and Outlook check SPF, DKIM and DMARC on your domain. Most websites send through the web host's PHP mail, which is not listed in the domain's SPF record and does not sign the mail, so the checks fail and the message is filed as spam. Sending through an SMTP plugin and a real mail service, plus the three DNS records, fixes it.

How do I check SPF, DKIM and DMARC on an email?

Open the email in Gmail, choose the three dots, then Show original. The top of the page lists SPF, DKIM and DMARC with PASS or FAIL for each.

Can I have two SPF records?

No. Two TXT records starting v=spf1 make SPF fail with a PermError. Merge them into one record with an include: for each service that sends mail for you.

More fixes

Your website's emails land in spam or junk

The contact form works, orders go through, password resets are sent, but customers find the email in their spam or junk folder, or Gmail shows a red "Be careful with this message" banner. Since 2024 Gmail, Yahoo and Outlook check three DNS records on your domain (SPF, DKIM and DMARC) before trusting a message. Mail that fails them is filed as spam, or refused. Here is how to read the verdict and fix it.

What the customer sees

mail.google.com - inbox

What the checks found

Why it happened (five minutes)

Read the verdict Gmail wrote. Send a test from your site to a Gmail address, open it, then the three dots, "Show original". The top lines say SPF: PASS or FAIL, DKIM and DMARC. Each FAIL is one reason it went to spam.
Who actually sent it? By default WordPress sends with PHP mail() from your web host's server, while the From line says your domain. To Gmail that is a stranger's server using your name, so SPF fails.
Is there an SPF record? Look up your domain's TXT records (any DNS lookup tool, or your DNS host's panel). One record should start v=spf1 and name every service that sends for you. Two v=spf1 records count as none.
Is mail signed (DKIM)? Your mail service gives you a DKIM record to add (a TXT or CNAME such as google._domainkey). Without it there is no signature to check.
Is there a DMARC record? A TXT record at _dmarc.yourdomain.com starting v=DMARC1. Gmail and Yahoo require one from anyone sending in volume, and its absence counts against you.
Does the From address match the site? A form that sends "From: the customer's own Gmail address" fails every check, because Gmail knows your server is not Gmail.

Fix it, safest first

Send through a real mail service. Install one SMTP plugin (WP Mail SMTP, FluentSMTP or Post SMTP) and connect it to the mailbox you already pay for (Google Workspace, Microsoft 365, Zoho) or a sending service (Brevo, Mailgun, SendGrid, Amazon SES). The plugin's test email should show "sent".
Fix SPF. Keep exactly one TXT record starting v=spf1, list each service with its own include: (for example include:_spf.google.com), and end it with ~all. Merge two records into one.
Turn on DKIM. Copy the DKIM record from the mail service into your DNS, then press "Verify" or "Start authentication" in the service's admin.
Add DMARC. Start gentle: a TXT record at _dmarc with v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Move to p=quarantine once a couple of weeks of reports show your real mail passing.
Fix the form's From and Reply-To. From: an address on your own domain (for example website@yourdomain.com). Reply-To: the customer's address, so replying still reaches them.
Confirm. Send another test to Gmail and "Show original" again: SPF, DKIM and DMARC should all say PASS. DNS changes can take up to an hour to show.

What you see, what it means, what it needs

What you see	What it means	Usual fix
Form emails always in spam	Sent by the web host's PHP mail, SPF fails	SMTP plugin through your mailbox or a sending service
"Show original": SPF FAIL or SOFTFAIL	The sending server is not in your SPF record	Add the service's `include:` to the one SPF record
SPF PermError	Two SPF records, or more than 10 lookups	Merge into one record, drop services you no longer use
DKIM: none or FAIL	Mail is not signed for your domain	Add the service's DKIM record, then verify it
DMARC: FAIL, or no DMARC at all	The From domain does not match a passing SPF or DKIM, or no record	Add a `_dmarc` record, send From your own domain
Red "Be careful with this message" banner	Gmail could not confirm who sent it	All three checks to PASS
Outlook or Hotmail bounces with 550 5.7.515	Microsoft now refuses unauthenticated bulk mail	SPF, DKIM and DMARC, same as above

What not to do

Do not add a second SPF record for the new service. Edit the one you have; two records break both.
Do not start DMARC at p=reject. One forgotten sender (an invoicing tool, a newsletter) would have its mail refused.
Do not ask customers to "check spam and mark as not spam". It helps that one inbox, not the next customer.
Do not send the form email "From" the visitor's address. That is exactly what spoofed mail looks like to Gmail.

Most cases are one SMTP plugin and three DNS records. If you are not sure which services send for your domain, the DNS host is confusing, or you would rather not touch it, that is what the box below is for. Related: emails not arriving at all, spam coming in through your contact form.