Email from WordPress

Module 9: Email, search visibility, GDPR, maintenance and migrating · Reading time: 9 minutes

Learning objective: After this lesson, you'll be able to make sure mail from WordPress (forms, orders, password links) arrives reliably.

Key concepts: wp_mail, PHP mail(), sender (From), Reply-To, SMTP, SMTP plugin, authenticated mailbox, transactional mail service, SPF, DKIM, DMARC, alignment, MX elsewhere, test email

WordPress sends more mail than you think

Your website sends mail when: a contact form is filled in, an order is placed (to the customer and to you), a new user is created, a password is forgotten, a new comment comes in, an automatic update runs, a critical error occurs (lesson 5.4). If that mail doesn't arrive, you often only notice when a customer calls: "I've filled in the form three times."

How WordPress sends mail by default

WordPress sends everything through the function wp_mail. By default, this hands the mail to the PHP function mail(), which passes it to the web server's mail program. This works, but has three weak points:

1. The sender. Without any settings, WordPress sends as wordpress@example.com. If that address doesn't exist, or the sender differs from your own domain, recipients distrust it.
2. SPF, DKIM and DMARC. Receiving mail servers check whether the server delivering the mail is allowed to send mail on behalf of your domain (SPF), whether the mail has a valid digital signature from your domain (DKIM), and what your domain's policy is if that doesn't check out (DMARC). The DNS course (lessons 4.3 to 4.5) explains how this works. Mail via the web server only passes those checks if your DNS and the server are set up for it.
3. Mail elsewhere. If your email isn't hosted with your web host but, for example, with Microsoft 365 or Google Workspace (your MX records point there), mail via the web server often doesn't match your SPF and DKIM. And some web servers try to deliver mail to your own domain locally instead of via the MX, so it never reaches your actual mailbox.

Setting the sender and Reply-To correctly

A common mistake with contact forms: using the visitor's address as the sender (From). This seems logical ("then I can just hit reply"), but your server isn't allowed to send mail on behalf of @gmail.com or @hotmail.com. Those domains have a strict DMARC policy, so the recipient either rejects the mail or marks it as spam.

The correct approach is:

From:     Website <website@example.com>      (an address on your own domain)
Reply-To: bezoeker@example.net               (the address the visitor entered)
To:       info@example.com

With Reply-To, your reply still reaches the visitor. Almost every form plugin has these two fields separately.

SMTP: sending via a real mailbox

The most reliable solution is to have WordPress send mail via SMTP: the same way your mail program sends mail, with a username and password of a real mailbox. You do this with an SMTP plugin (for example WP Mail SMTP, FluentSMTP or Post SMTP; there are more). The plugin intercepts wp_mail and sends the mail via the server you specify:

Advantages: the mail passes through a server that's already set up with SPF and DKIM for your domain, the sender is an existing address, and many plugins keep a log, so you can see what was sent and what failed.

Keep a few things in mind:

• Use a separate mail address for the website (for example website@), not your own mailbox. If the website is hacked and the password leaks, that address can be replaced without any damage.
• The SMTP password is stored in the database or in wp-config.php. Use an app password or a passwordless connection where possible.
• A mail log contains personal data (who sent what). Don't let it grow indefinitely (lesson 9.3).

SPF, DKIM and DMARC for your website

Whichever server sends the mail, your DNS needs to match:

• SPF: your domain's SPF record must name the server that delivers the mail. If you send mail via your host's mail server, it's usually already included. If you send via a transactional service, add their include: to the same SPF record (never a second SPF record, DNS course lesson 4.3).
• DKIM: the sending server must sign the mail with a key that's in your DNS (<selector>._domainkey.example.com). You enable this with your host and with transactional services; the service gives you the records.
• DMARC: a record at _dmarc.example.com. Start with p=none and tighten it once everything checks out (DNS course lesson 4.5).

For DMARC, the domain in the From must be aligned with the domain that passes SPF or DKIM. That's why "From on your own domain" matters so much.

Testing

1. Many SMTP plugins have a Send test email button. Send one to an address at a different provider (a Gmail or Outlook.com address) and check whether it reaches the inbox.
2. Look at the headers of that mail ("Show original" or "View source"). Look for spf=pass, dkim=pass and dmarc=pass.
3. Fill in your own contact form and check whether the mail arrives, with the correct Reply-To.
4. Also test a password link and, for a shop, a test order.

Online tools such as mail-tester.com give a score and explanation; use your host's E-mail check (that's what it's called at WebOké) or internet.nl to check the DNS side.

In practice: what this looks like in a panel

As an example, we use DirectAdmin and an SMTP plugin. With other hosts and plugins, the fields work in a similar way.

1. In DirectAdmin, under E-mail accounts, create a mailbox website@example.com with a strong password.
2. Look up your host's outgoing mail settings (server name, port 465 or 587, encryption).
3. Enter these in the SMTP plugin, with website@example.com as the sender. Turn on "force sender", so that other plugins use this address too.
4. Check under DNS management that SPF, DKIM and DMARC exist for your domain.
5. Send a test email and read the headers.

Summary

• WordPress sends via wp_mail and by default via PHP mail(); the sender and the DNS determine whether it arrives.
• Set the sender (From) to an address on your own domain, and the visitor's address in Reply-To.
• An SMTP plugin with a separate mailbox or a transactional service is the most reliable option, with a log.
• SPF must name the sending server (in one record), DKIM must be enabled, DMARC should start with p=none.
• Test with an address at a different provider and check spf, dkim and dmarc in the headers.

Quiz

Exercise

Exercise A9.1: Is your domain ready to send mail from your website? Enter your domain, the address your website uses as the sender, and the server through which your website sends mail (the name of the SMTP server, or "web server" if you haven't configured anything). Also enter the DKIM selector if you know it. The tool checks: the sender address belongs to your domain, there's exactly one SPF record and it permits the named server, there's a DKIM record at the selector (or it reports that it can't check without a selector), and there's a valid DMARC record.

Exercise D9.1: Reading a test email. Send a test email from your website (the test button of your SMTP plugin, or a password link to a test account) to an address at a different provider. Open the headers of that mail and note the outcomes for spf, dkim and dmarc, and which domain appears with each. Then fill in your own contact form and check: does the mail arrive, and does "reply" go to the address entered in the form?

Further reading

These articles describe the steps in WebOké's panels; in other panels they work in a similar way.

• Sending email via PHP fails, MX records point elsewhere
• How do I get the correct sender with mail() in PHP? SMTP
• A contact form on your website: have fields emailed and prevent spam
• How sending email works / SMTP
• DirectAdmin guide 18.10: I can't send email
• Free DNS course 4.3: SPF: who's allowed to send mail on behalf of your domain?
• Free DNS course 4.4: DKIM: the signature under your mail
• Free DNS course 4.5: DMARC: what receivers should do with fake mail