WordPress deliverability · Beginner · 20 minutes
How to send email from WordPress reliably — WordPress Mail: Stop Using mail(), Start Reading Headers
Enquiries are vanishing between the form and your inbox, and WordPress is reporting every single one of them as sent.
The short answer
WordPress sends through wp_mail, which by default hands the message to PHP's mail() function and out through the local sendmail binary — unauthenticated, with an envelope sender the web server chose. That pattern is the one inbox providers trust least.
The fix is to route wp_mail through authenticated SMTP on a real mailbox at your own domain, then verify from the headers of a delivered message rather than from the plugin's success notice. wp_mail is a single hook, so core, WooCommerce and every form plugin inherit the repair at once.
By the HostingFast team · Reviewed 24 August 2026
Beginner
Difficulty grade
20 minutes
Time budget
5
Stages
24/7
Engineer cover
Assumed knowledge: you can install a plugin and create a mailbox. Everything else here is mechanism — what the default does, why it fails, and what evidence proves it is fixed.
There is a performance note at the end that most guides omit: sending SMTP synchronously adds latency to the request that triggered it, which matters as soon as volume does.
What wp_mail actually does by default
wp_mail wraps PHPMailer, and with no SMTP configuration PHPMailer calls PHP's mail(), which shells out to the local sendmail binary. The message leaves with no authentication, and the envelope sender is whatever the web server supplies rather than an address you own.
Receivers score that pattern harshly, and rightly: it is indistinguishable from a compromised web host sending on somebody else's behalf. The message is not rejected loudly — it is accepted and filed in spam, which is why WordPress reports success while nothing arrives.
Rerouting every plugin in one move
An SMTP plugin — WP Mail SMTP, FluentSMTP or similar — filters wp_mail globally. Core notifications, WooCommerce order mail, contact form notifications and password resets all travel the new path without any of them being reconfigured.
The settings that matter are host, port and encryption: 587 with STARTTLS or 465 with implicit TLS, authentication on, using a mailbox at your own domain. Store the password as a constant in wp-config.php rather than in the database if the plugin supports it.
From address, Reply-To, and the alignment rule
The From address must be the authenticated mailbox. Setting From to the enquirer's own address — which several form plugins do out of the box — forges mail in a domain you do not control, and DMARC at the receiving end is designed to stop exactly that.
Put the enquirer in Reply-To instead. Deliverability gets its alignment, replying still reaches the right person, and the notification stops looking like a spoof to the very inbox you want it in.
Proving it, and the latency nobody mentions
Send the plugin's test message to an external mailbox, open the original, and read Authentication-Results. spf=pass and dkim=pass against your own domain is the receipt. A test to another address on the same server proves nothing, because local delivery never leaves the machine.
Then the footnote: PHP sends SMTP synchronously, so the visitor whose form submission triggers the mail waits for the SMTP conversation to finish. One message is a few hundred milliseconds; a WooCommerce order firing four is not. Queue the sending, or move volume onto a transactional service, and the checkout stops paying for the mail.
The platform these tests were run on
Every setting here was exercised on the stack we operate — cPanel mailboxes, the same SMTP service, the same ports — so the values in the guide are the values your account expects.
Support is a human being at any hour, and the scope covers the awkward practical questions other hosts bounce straight back at you.
- Mechanism before configuration
- Verified from delivered headers
- One hook, every plugin fixed
- Engineers on shift at any hour
Why HostingFast
Standard on every plan
The default explained, not just replaced
Why PHP mail() fails authentication is the reason the SMTP fix works, so it is stated rather than skipped.
One filter, every plugin
wp_mail is a single hook, so core, WooCommerce and your form plugin all inherit the repair at once.
From and Reply-To, correctly
The alignment rule that stops your own form notifications looking like forged mail.
Proof in the headers
A test that ends in spf=pass and dkim=pass on a delivered message, not a green tick in a settings screen.
The latency footnote
Synchronous SMTP is added to the response time of the request that triggers it — worth knowing before volume arrives.
Mailboxes already included
The authenticated mailbox this needs is part of the plan rather than an add-on at checkout.
Quick Start
From order to online
- 1
Reproduce the failure and read the log
Trigger the mail that goes missing and check the plugin or server log. Sent-and-filtered and never-sent are two different problems, and the log tells them apart in seconds.
- 2
Create a dedicated mailbox for sending
Something like wordpress@yourdomain in cPanel, with its own generated password. A shared human mailbox is the wrong credential to put in a plugin.
- 3
Install and configure the SMTP plugin
Host, port 587 with STARTTLS or 465 with TLS, authentication on, credentials for the new mailbox. Prefer wp-config.php constants over storing the password in the database.
- 4
Set From to the mailbox and Reply-To to the human
Every form plugin needs checking here, because several default to putting the visitor in From and quietly breaking alignment for the whole domain.
- 5
Test externally, then exercise the real flows
Send to an outside mailbox and read Authentication-Results. Then place a test order and submit a real enquiry, because those are the paths that actually cost you money when they fail.
Built In
Loaded onto every plan
- Mailboxes on your own domain, included with the plan
- IMAP, POP, SMTP and browser webmail on every mailbox
- LiteSpeed caching in the server itself, not bolted on by plugin
- Staging environments for testing before anything ships
- Daily backups with restores you trigger yourself from the panel
- WordPress Toolkit handling core and plugin updates for you
- 99.9% uptime as the target, monitored around the clock
- Free SSL on every plan, renewed automatically before it can expire
- Softaculous on every account for scripted application installs
- No setup fee on any plan, ever
Frequently Asked
What people ask us most often
Should the From address be the visitor's email?
No. Putting the visitor in From means your server sends mail claiming to be from a domain you do not control, and DMARC exists specifically to stop that. Put the authenticated mailbox in From and the visitor in Reply-To — you get delivery and a working reply button.
Does routing mail through SMTP slow down page loads?
Yes, measurably, because PHP holds the request open for the SMTP conversation. A single notification costs a few hundred milliseconds; several on one checkout is enough to notice. Queue the sending, or hand bulk and transactional volume to a dedicated service, and the visitor stops waiting for it.
Which company stands behind HostingFast?
HostingFast is a trading name of Vitalcare at Home Ltd, registered in England and Wales — a real company with a public record and terms governed by English law. Running that check on any host before handing over a domain is time well spent.
On cancellation, what happens to the files and the domain?
They stay yours. Download a full backup from the panel any time you like, before or during cancellation. Domains remain registered in your name for the term you paid for and can transfer to any registrar once the standard 60-day window passes.
Keep reading
How to Change Your PHP Version
A newer runtime selected per site, with the before-and-after numbers recorded.
How to Add SSL to WordPress
Every page served over https and the mixed-content references swept out of the database.
Best Wix vs WordPress
The two approaches compared on what each costs you in speed, control and lock-in.
WHMCS License
Billing, provisioning and support automated for your own hosting clients.
Agency Hosting
Client accounts, staging and care-plan infrastructure built for agency workloads.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Make the notifications arrive.
Mailboxes on your own domain, free SSL, free migration, and engineers on shift at any hour of the night.
View WHMCS License plans