How do you set up WordPress SMTP with SPF and DKIM?

WordPress sends email for password resets, contact forms, WooCommerce orders and admin alerts. Out of the box it hands those messages to the web server's mail program, and many of them land in spam or never arrive. This guide shows how to switch WordPress to authenticated SMTP, which settings to use for Microsoft 365, Google and typical hosts, and the DNS records that make receivers trust the result.

Why does WordPress email go to spam?

WordPress email goes to spam because, by default, it's sent unauthenticated from the web server. WordPress core calls PHP's mail() through the PHPMailer library, and if nothing sets a sender, the From address is wordpress@ followed by your site's domain. That server usually isn't in your SPF record and doesn't sign with DKIM for your domain, so receivers can't tell the mail is really yours.

Google's sender guidelines require every sender to "set up SPF or DKIM email authentication for your sending domains", and anyone sending 5,000 or more messages a day to Gmail needs SPF, DKIM and DMARC. Our guide on website form emails going to spam explains the mail() problem and form-specific issues in more depth. This guide is the setup.

What do you need before you start?

Have these ready before you change anything:

1. One sending address on your domain, such as website@example.com. It doesn't need to receive mail, but a real mailbox makes bounces easier to read.
2. A sending service that will accept authenticated SMTP from your site (see the next section).
3. The SMTP host, port, encryption type and credentials from that service.
4. Access to your DNS at your registrar or DNS host, to edit SPF and add DKIM records.
5. A test mailbox at an outside provider, such as a personal Gmail or Outlook.com account.

Which SMTP service should WordPress use?

Use the service that already sends your domain's mail if its limits fit, or a transactional email service for anything that emails customers. These settings were checked on each provider's own pages at the time of writing (November 2026).

The Microsoft figures come from Microsoft Learn, which also warns: "If your device or application recommends or defaults to TCP port 465, it doesn't support the required versions of TLS" for Microsoft 365. The Google figures come from Google Workspace Admin Help. For the relay's Admin console steps, see our Google Workspace SMTP relay guide.

Microsoft 365: two things to check first

SMTP AUTH is off for many tenants. Microsoft says it's "disabled for organizations created after January 2020", and security defaults also block it. To turn it on for just the sending mailbox, go to the Microsoft 365 admin center > Users > Active users, select the user, then Mail > Manage email apps and tick Authenticated SMTP. In Exchange Online PowerShell:

Set-CASMailbox -Identity website@example.com -SmtpClientAuthenticationDisabled $false

Microsoft is also retiring password (Basic) sign-in for SMTP AUTH. Its current timeline disables it by default for existing tenants at the end of December 2026. Use a plugin that signs in with OAuth, or another sending method. Our SMTP AUTH retirement guide tracks the dates.

How do you configure WordPress to send through SMTP?

You configure WordPress for SMTP either with an SMTP plugin or with a short must-use plugin that hooks phpmailer_init. Both do the same thing: WordPress fires that hook before each send, and the developer reference shows how to switch PHPMailer to SMTP there.

Option 1: an SMTP plugin

Install a well-maintained SMTP plugin from the WordPress plugin directory and enter the host, port, encryption and credentials from the table. Prefer one that supports OAuth for Microsoft 365 and Google, keeps a log of each attempt, and lets you force the From address. Test with the plugin's own "send test email" button first.

Option 2: a must-use plugin, no settings screen

Must-use plugins live in wp-content/mu-plugins, are "automatically enabled on all sites in the installation" and "cannot be disabled from wp-admin" (WordPress documentation). That makes them a stable home for mail settings.

First, add your settings to wp-config.php, above the line that says to stop editing. This example uses a transactional service; swap in your own values:

define( 'SITE_SMTP_HOST', 'smtp.mailservice.example' );
define( 'SITE_SMTP_PORT', 587 );
define( 'SITE_SMTP_SECURE', 'tls' );   // 'tls' = STARTTLS on 587, 'ssl' = TLS on 465
define( 'SITE_SMTP_USER', 'smtp-username' );
define( 'SITE_SMTP_PASS', 'smtp-password-or-api-key' );
define( 'SITE_MAIL_FROM', 'website@example.com' );

Then create wp-content/mu-plugins/site-smtp.php:

<?php
/**
 * Plugin Name: Site SMTP
 * Description: Sends wp_mail() through authenticated SMTP using settings in wp-config.php.
 */
if ( ! defined( 'SITE_SMTP_HOST' ) ) {
    return;
}

add_action( 'phpmailer_init', function ( $phpmailer ) {
    $phpmailer->isSMTP();
    $phpmailer->Host       = SITE_SMTP_HOST;
    $phpmailer->Port       = SITE_SMTP_PORT;
    $phpmailer->SMTPSecure = SITE_SMTP_SECURE;
    $phpmailer->SMTPAuth   = true;
    $phpmailer->Username   = SITE_SMTP_USER;
    $phpmailer->Password   = SITE_SMTP_PASS;
    $phpmailer->Sender     = SITE_MAIL_FROM; // envelope sender (Return-Path)
} );

add_filter( 'wp_mail_from', function () {
    return SITE_MAIL_FROM;
} );

add_filter( 'wp_mail_from_name', function () {
    return 'Example Co website';
} );

add_action( 'wp_mail_failed', function ( $error ) {
    error_log( 'wp_mail failed: ' . $error->get_error_message() );
} );

What each part does:

• isSMTP() and the connection settings replace PHP mail() with an authenticated SMTP session.
• Sender sets the envelope sender. PHPMailer uses it as the SMTP MAIL FROM, which is the domain SPF checks. Some services replace it with their own bounce domain; that's normal, and DKIM then provides the alignment.
• The wp_mail_from filter runs on every message, so forms that put the visitor's address in From are overridden. Make sure your form plugin puts the visitor in Reply-To instead.
• wp_mail_failed is a core WordPress action that fires when sending fails. Here it writes the error to the PHP error log.

Keep wp-config.php out of version control and readable only by the web server user, since it now holds a mail password.

How do you set up SPF for WordPress email?

Add your sending service to your domain's one SPF record. RFC 7208 allows only one SPF record per name; two records cause a permanent error, so SPF fails for everything.

For example, a domain on Microsoft 365 that adds a transactional service changes this:

example.com.  TXT  "v=spf1 include:spf.protection.outlook.com -all"

to this, using the include your service documents:

example.com.  TXT  "v=spf1 include:spf.protection.outlook.com include:spf.mailservice.example -all"

If WordPress sends through Microsoft 365 or Google itself, your existing Microsoft 365 or Google Workspace include already covers it. If you send through your host's server, add the include or IP address your host gives you. Check the result, including the 10-lookup limit, with the SPF Checker.

How do you set up DKIM for WordPress email?

DKIM is set up at the sending service, not in WordPress: the service signs each message, and you publish its public key in DNS.

• Microsoft 365: turn on DKIM for your custom domain in the Microsoft Defender portal and publish the two CNAME records. See DKIM setup for Microsoft 365 and Google Workspace.
• Google Workspace: generate the key in the Admin console, publish the TXT record, then start authentication. The same guide covers it.
• Transactional services: add your domain in the service's dashboard and publish the CNAME or TXT records it shows. Our DKIM provider pages list the record format for common services such as Amazon SES and SendGrid.
• cPanel hosting: cPanel's Email Deliverability interface checks a domain's DKIM, SPF, DMARC and reverse DNS (PTR) records, and can repair invalid ones when the server controls the domain's DNS.

Verify the published key with the DKIM Checker. The DKIM d= domain must be your domain, or a subdomain of it, for DMARC to pass with relaxed alignment.

How do you test WordPress email after setup?

1. Send a password reset to your outside test mailbox from the WordPress login page.
2. Send a test to the Email Deliverability Test to see SPF, DKIM, DMARC, reverse DNS and spam results for one real message.
3. Open the headers of the delivered copy in the Email Header Analyzer. You want spf=pass or dkim=pass for your domain, and dmarc=pass.
4. Submit each form on the site and confirm the From is your address and Reply-To is the visitor.
5. Check the error log for wp_mail failed lines, or your plugin's mail log.
6. Publish DMARC if you haven't. Start at p=none with a reporting address, and use the DMARC Checker to confirm it.

What do common WordPress SMTP errors mean?

For port choices, see SMTP ports 25, 587 and 465.

Next steps

1. Pick one sending service, set one From address on your domain, and switch WordPress to SMTP with a plugin or the code above.
2. Add the service to your SPF record, turn on DKIM for your domain, and publish DMARC.
3. Run the free Email Deliverability Test after every change.
4. If your site and other systems send business notifications, iBlockSpam's outbound relay works as a smart host with DKIM signing and outbound filtering, with 500 messages a month included on both plans.

Browse more guides on running email day to day.