Bits of .NET

📝 Password Reset Emails in Spam? It’s Not WordPress’s Fault

Order confirmations, password resets, and contact form notifications landing in spam (or not arriving at all) usually has nothing to do with WordPress itself — it’s that PHP’s default mail() function sends from an unauthenticated address your domain never told the world to trust.

🔍 Why This Happens

WordPress's default wp_mail() typically uses PHP's mail()
function under the hood, which often sends "From" an address like
wordpress@yourserver.com with no authentication behind it.
Receiving mail servers (Gmail, Outlook, etc.) check SPF and DKIM
records to verify a sending server is actually authorized to send
on behalf of your domain - if there's no matching record, or the
sending server isn't listed, spam filters treat it as suspicious.

✅ The Real Fix: Send Authenticated Mail, Not PHP’s Default

• Use an SMTP plugin (WP Mail SMTP or similar) configured with a real transactional email service (an email API/SMTP provider) instead of PHP’s mail().
• That service handles proper SPF/DKIM authentication for you — this alone fixes the vast majority of WordPress spam-folder issues.

📧 The One DNS Record Piece That Matters Most

If you're sending from your own domain (not a shared @gmail-type
address), add an SPF record authorizing your mail provider:

TXT record on your domain:
v=spf1 include:_spf.yourmailprovider.com ~all

This tells receiving servers "yes, this provider IS allowed to
send email claiming to be from my domain" - without it, even
correctly configured SMTP can still land in spam.

⚠️ Also Worth Checking

• DKIM (a cryptographic signature your mail provider adds) is usually configured automatically once you connect a transactional email service — check their setup docs for the exact DNS record they need.
• Use a tool like mail-tester.com to send a test email and get a concrete spam score plus exactly which check (SPF/DKIM/DMARC) is failing.