WordPress Email Q&A

Direct answers to the WordPress email questions people actually type into search engines. Some are diagnostic (why a contact form reaches Office 365 but not Gmail, why password reset messages never land), some are decision-making (which SMTP plugin to pick, whether to move from free Gmail to Google Workspace, whether one setup can serve an agency’s client sites), and some are conceptual (what DKIM and SPF do inside WordPress, whether plugins can read the mail your site sends). One entry per question, grouped by the shape of the answer.

Start here

The WordPress email that fails most often is the password reset. If that is what brought you here, open Users not receiving password reset emails first: it walks through the four things that break it (missing SMTP, spam scoring, cache masking success, transient upstream failures) and points at the fix for each. The rest of this page groups the questions by what they are actually about.

Users not receiving password reset emails in WordPress

WordPress password reset email fails for five distinct reasons. This diagnostic identifies which is causing the problem and gives the specific fix for each.

How WordPress email actually works

Can I change the look of emails sent by WordPress?

Yes, via three paths depending on which emails you want to change. WooCommerce order emails have a template override system in the theme. Core WordPress emails are filterable but not templated. Anything else takes an HTML-email plugin.
Can I use a third-party email service with WordPress?

Yes, and for any WordPress site that needs to send reliable email, a third-party sending service is the standard setup. The provider gives you an authenticated outbound pipeline; a mailer plugin routes wp_mail() through it.
Can I use Outlook for my WordPress email?

Yes, both personal Outlook.com and Microsoft 365 mailboxes work as WordPress SMTP relays, using different hosts and authentication. Microsoft 365 needs OAuth and hits daily send limits; personal Outlook.com is smaller and only for hobby sites.
Can WordPress plugins read the emails my site sends?

Yes. Any active WordPress plugin can hook wp_mail and read the recipient, subject, body, headers, and attachments of every outbound message. The trust boundary sits at plugin install, not at send time.
Change the WordPress admin email when the old inbox is unreachable

The Settings → General confirmation flow needs a working old mailbox. Three bypasses (WP-CLI, direct DB, one-shot mu-plugin) update admin_email without it.
Didn’t get the WordPress recovery mode email?

The “check your inbox” line doesn’t mean WordPress sent the recovery mode email. It sends one a day at most, through the mail setup that may have just broken.
Host breached: are my WordPress email credentials exposed?

Probably, if your host’s notice names files or databases, or is vague. Where each WordPress SMTP password, API key or OAuth token is kept decides which leaked.
How do I change the “from” address of emails sent from WordPress?

Set the “From Email” override in your mailer plugin (WP Mail SMTP, FluentSMTP, or Post SMTP) and enable “Force From Email” so plugins can’t override it. That covers ninety-nine percent of sites. Filter or dedicated plugin covers the rest.
How do I create a contact form on my WordPress site?

Install a contact form plugin, build a form in its editor, and drop the plugin’s block or shortcode onto the page where the form should appear. WordPress does not ship a contact form out of the box; a plugin is the standard route.
How do I enable email notifications in WordPress?

WordPress core sends notification emails by default for new users, password resets, comment approvals, and other events. If notifications are not arriving, the problem is almost always deliverability, not a WordPress setting.
How do I switch off WordPress automatic emails without breaking anything?

WordPress core sends about twenty transactional emails. Three categories (safe, administrative, recovery) decide which to silence. Never drop password resets.
How does WordPress send emails?

WordPress calls wp_mail(), which hands off to PHPMailer, which by default calls PHP’s mail() function on the local server. Most operators replace that path with authenticated SMTP via a plugin.
Is there an EU-based SMTP service for WordPress?

Yes. Brevo, Mailjet and Maileroo keep mail in the EU by default; Mailgun, SendGrid and others offer an EU region. What each covers, and the setting to match.
Plugin compromised: do I rotate my SMTP keys?

Yes. Code that ran inside WordPress could read every mail credential your SMTP plugin stores, encrypted or not. What to rotate, in what order, what to check.
What is the best way to set up email on WordPress?

A mailer plugin paired with a transactional email provider. The plugin replaces WordPress’s default sending path; the provider gives you an authenticated pipeline that lands mail in the inbox.
Will the WP Secrets API replace SMTP constants?

WordPress 7.2 adds a Secrets API for encrypted credentials. What the proposal defines, what it means for SMTP plugins, and what site owners need to do today.

Getting mail delivered

Best way to set up SMTP for client websites?

Standardise SMTP across client sites by opening one transactional provider account per client, on the client’s domain, with credentials held by the agency.
Can I use a third-party email service with WordPress?

Yes, and for any WordPress site that needs to send reliable email, a third-party sending service is the standard setup. The provider gives you an authenticated outbound pipeline; a mailer plugin routes wp_mail() through it.
Domain suspended: what breaks in WordPress email?

A registrar suspension breaks WordPress email in stages: inbound bounces, outbound fails your domain’s DKIM and DMARC, resets go nowhere. What to fix, in order.
How can WordPress send emails under my own domain name?

Yes. Three DNS records on your domain (SPF, DKIM, and optionally DMARC) let a WordPress site send authenticated mail from an address on your own domain, through whichever transactional provider you configure. The records are published at your DNS host, not inside WordPress.
How does WordPress send emails?

WordPress calls wp_mail(), which hands off to PHPMailer, which by default calls PHP’s mail() function on the local server. Most operators replace that path with authenticated SMTP via a plugin.
How secure is the Mandrill-Mailchimp integration for a WordPress site?

Mandrill security is Mailchimp parent-account security. The Transactional dashboard shares the Mailchimp login, so what reaches one reaches the other. Here is the audit a WordPress site should actually run.
Is there an EU-based SMTP service for WordPress?

Yes. Brevo, Mailjet and Maileroo keep mail in the EU by default; Mailgun, SendGrid and others offer an EU region. What each covers, and the setting to match.
Send email from a Cloudflare-hosted static site

Cloudflare Email Routing forwards inbound but does not send. Three outbound paths for a static site: a mailbox host, a transactional relay behind a form endpoint, or a Worker that calls a sending API.
Should WordPress send its email from a subdomain, and does that protect the main domain?

A subdomain gives WordPress newsletter mail its own DKIM reputation signal only when signed for the subdomain, and never fully cuts the tie to the main domain.
What are DKIM and SPF and how do they relate to WordPress?

DKIM and SPF are DNS records that let mailbox providers verify a WordPress site’s outbound mail is authorised to send as your domain. Neither is WordPress-specific; both are essential to any site whose email is expected to reach the inbox.
What is the best way to set up email on WordPress?

A mailer plugin paired with a transactional email provider. The plugin replaces WordPress’s default sending path; the provider gives you an authenticated pipeline that lands mail in the inbox.
Why are my WordPress emails not being delivered?

WordPress email fails for four distinct reasons. This diagnostic sorts between them and gives the fix for each, from the disabled mail() function on shared hosts through unauthenticated From addresses that Gmail treats as spam.
Why does my Spamhaus check say “not listed” for every IP?

Spamhaus refuses lookups through Google, Cloudflare and many hosts, and checks often read the refusal as “not listed”. A test lookup shows if yours does.
Why is Outlook putting my WordPress emails in Promotions?

Microsoft 365 Outlook can file mail it judges promotional in a Promotions folder, WordPress receipts included. What is known, and what a site can test.

Authentication: DKIM, SPF, DMARC

Can I use Outlook for my WordPress email?

Yes, both personal Outlook.com and Microsoft 365 mailboxes work as WordPress SMTP relays, using different hosts and authentication. Microsoft 365 needs OAuth and hits daily send limits; personal Outlook.com is smaller and only for hobby sites.
Can WordPress plugins read the emails my site sends?

Yes. Any active WordPress plugin can hook wp_mail and read the recipient, subject, body, headers, and attachments of every outbound message. The trust boundary sits at plugin install, not at send time.
Can WordPress send from a Microsoft 365 alias?

Yes, if the Microsoft 365 tenant has sending-from-aliases turned on and the alias is a proxy address on the sending mailbox. GA on October 7, 2026.
Does Microsoft’s EWS retirement break WordPress email through Microsoft 365?

No. The three WordPress mailer plugins that connect to Microsoft 365 send through SMTP or Microsoft Graph. EWS retirement doesn’t touch mail submission.
How can WordPress send emails under my own domain name?

Yes. Three DNS records on your domain (SPF, DKIM, and optionally DMARC) let a WordPress site send authenticated mail from an address on your own domain, through whichever transactional provider you configure. The records are published at your DNS host, not inside WordPress.
Our IT won’t grant Mail.Send to the WordPress app. What do we offer them?

WordPress mailer plugins ask for delegated Mail.Send, which acts as one signed-in account, not the whole tenant. What to offer IT, and the exits if IT says no.
Should WordPress send its email from a subdomain, and does that protect the main domain?

A subdomain gives WordPress newsletter mail its own DKIM reputation signal only when signed for the subdomain, and never fully cuts the tie to the main domain.
What are DKIM and SPF and how do they relate to WordPress?

DKIM and SPF are DNS records that let mailbox providers verify a WordPress site’s outbound mail is authorised to send as your domain. Neither is WordPress-specific; both are essential to any site whose email is expected to reach the inbox.
Why does Microsoft 365’s DKIM CNAME drop the hyphen from my domain?

In every hyphenated domain we checked, Microsoft 365’s DKIM CNAME dropped the hyphen and added a short suffix. It is not a copy error, so publish the values as given.

Gmail and Google Workspace

Best way to set up SMTP for client websites?

Standardise SMTP across client sites by opening one transactional provider account per client, on the client’s domain, with credentials held by the agency.
Form not sending mail to Gmail (but sending to Office 365)

Gmail rejects unauthenticated mail; Microsoft 365 downgrades it to Junk. Here is why your form reaches Office 365 but not Gmail, and how to fix it.
What is the difference between Google Workspace Gmail and free Gmail?

Free Gmail at gmail.com is free. Google Workspace costs $7/user/month and adds custom-domain mail, higher SMTP limits, and admin controls. What changes for a WordPress site.

Contact forms

Block certain countries from Contact Form 7?

CF7 geo-blocking works via Cloudflare WAF, Wordfence Premium, or GeoIP plugins. For brand-confusion volume, a form-level filter usually works better.
Can messages from my contact form go directly into my CRM?

Yes. Three routes exist. Your form plugin’s native CRM integration, the CRM vendor’s own WordPress plugin, or a general-purpose connector like Zapier or Make. Native integrations are the shortest path when the plugins line up.
Contact Form 7 “error trying to send your message” when the SMTP test works

The red Contact Form 7 error means the form’s email failed to send. Why the SMTP plugin’s test still passes, where the real error is logged, and what to change.
Contact Form 7 v6.2 broke my site: recovery steps

Contact Form 7 v6.2 raised its PHP floor to 8.3 and crashed older WordPress sites. Shell recovery, and how to pin one plugin without disabling the rest.
How do I create a contact form on my WordPress site?

Install a contact form plugin, build a form in its editor, and drop the plugin’s block or shortcode onto the page where the form should appear. WordPress does not ship a contact form out of the box; a plugin is the standard route.
How do I create an email autoresponder in WordPress?

Use a contact form plugin that supports a second notification email, and set that second notification to send to the submitter with your acknowledgement copy. Every mainstream form plugin either includes autoresponders or has an add-on that does.
How do I protect my WordPress contact form from spam?

Combine a bot filter (honeypot or Cloudflare Turnstile) with content filtering (Akismet or Antispam Bee). Every serious form plugin ships with hooks for both; turn them on before the form goes live rather than after the spam starts.
What’s a modern contact form plugin for WordPress to replace Contact Form 7?

Fluent Forms is the usual move off Contact Form 7. But every popular form plugin sends through wp_mail(), so swapping is a UX move, not a delivery fix.

Troubleshooting

Change the WordPress admin email when the old inbox is unreachable

The Settings → General confirmation flow needs a working old mailbox. Three bypasses (WP-CLI, direct DB, one-shot mu-plugin) update admin_email without it.
Contact Form 7 “error trying to send your message” when the SMTP test works

The red Contact Form 7 error means the form’s email failed to send. Why the SMTP plugin’s test still passes, where the real error is logged, and what to change.
Didn’t get the WordPress recovery mode email?

The “check your inbox” line doesn’t mean WordPress sent the recovery mode email. It sends one a day at most, through the mail setup that may have just broken.
Domain suspended: what breaks in WordPress email?

A registrar suspension breaks WordPress email in stages: inbound bounces, outbound fails your domain’s DKIM and DMARC, resets go nowhere. What to fix, in order.
Form not sending mail to Gmail (but sending to Office 365)

Gmail rejects unauthenticated mail; Microsoft 365 downgrades it to Junk. Here is why your form reaches Office 365 but not Gmail, and how to fix it.
Host breached: are my WordPress email credentials exposed?

Probably, if your host’s notice names files or databases, or is vague. Where each WordPress SMTP password, API key or OAuth token is kept decides which leaked.
How secure is the Mandrill-Mailchimp integration for a WordPress site?

Mandrill security is Mailchimp parent-account security. The Transactional dashboard shares the Mailchimp login, so what reaches one reaches the other. Here is the audit a WordPress site should actually run.
Is my hacked WordPress site sending spam?

Maybe, and your email log can’t rule it out: spam scripts calling PHP’s mail() skip WordPress. Your host’s mail logs show it; PHP’s mail log names the script.
Plugin compromised: do I rotate my SMTP keys?

Yes. Code that ran inside WordPress could read every mail credential your SMTP plugin stores, encrypted or not. What to rotate, in what order, what to check.
Why are my WordPress emails not being delivered?

WordPress email fails for four distinct reasons. This diagnostic sorts between them and gives the fix for each, from the disabled mail() function on shared hosts through unauthenticated From addresses that Gmail treats as spam.
Why does my Spamhaus check say “not listed” for every IP?

Spamhaus refuses lookups through Google, Cloudflare and many hosts, and checks often read the refusal as “not listed”. A test lookup shows if yours does.