The cost of a missing confirmation
A customer orders and hears nothing. They email to ask whether the order went through. They order again. They open a dispute with their card company because they have no proof of purchase. Every one of those is a WooCommerce email that did not reach an inbox, and on stores we inherit it is a routine finding rather than an exception.
WooCommerce sends a lot of email: new order, processing, completed, refunded, customer note, password reset, plus whatever subscriptions and marketing add. If the sending is not set up properly, a meaningful share of it lands in spam or is rejected outright, and the store never knows.
Why it fails
The web server is sending the mail. By default WordPress uses PHP's mail() function, which hands the message to the web server's local mail agent. That server has no reputation, is often on a shared IP that has sent spam for someone else, and is sending in your domain's name without your domain saying it may. Receiving mail servers treat that as a likely forgery.
No authentication records. Even when a proper mail service is used, if the domain's DNS has no SPF, DKIM or DMARC records covering that service, the receiver cannot verify the mail and downgrades it.
Reputation and volume. A store sending hundreds of emails a day from an unauthenticated source acquires a poor reputation quickly, and the poor reputation follows the domain, affecting the owner's normal email too.
The fix, in two parts
Part 1: move sending to a transactional email service
Stop the web server from sending mail. Route everything through a service built for it: Postmark, Resend, SendGrid, Brevo, Amazon SES, or Mailgun. On WordPress this is an SMTP or API plugin (WP Mail SMTP, FluentSMTP, or the service's own plugin) configured with the service's credentials. Every email WooCommerce sends then goes through the service, which has reputation, logs, bounce handling and deliverability monitoring.
Choose a service that separates transactional mail from marketing mail. Order confirmations should never share an IP or reputation with a newsletter.
Test by placing an order to a Gmail address and an Outlook address and checking both inboxes and spam folders.
Part 2: authenticate the domain
Three DNS records, added at wherever your domain's DNS is managed.
SPF lists the servers permitted to send for your domain. One combined TXT record on the root domain, including your normal email provider and the transactional service:
v=spf1 include:_spf.google.com include:spf.mtasv.net ~all(The include values come from your providers. There is one SPF record per domain; merge, never add a second.)
DKIM publishes a public key so receivers can verify the service's signature. The service gives you one or more CNAME or TXT records to add. Each sending service has its own.
DMARC declares the policy and where reports go. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comMove to p=quarantine once reports confirm all legitimate mail passes.
Verify with any SPF/DKIM/DMARC checker, then send another test order and use Gmail's "Show original" to confirm all three pass.
WooCommerce-specific settings
- From address. Set WooCommerce's sender address (WooCommerce, Settings, Emails) to an address on your domain, for example
orders@yourdomain.com, and make sure that domain is the one you authenticated. A from address on a different domain from the authenticated one fails alignment. - Reply-to. Set to a monitored inbox, so customers who reply to a confirmation reach a human.
- Content. Plain templates, order details, no all-caps subjects. Heavy HTML templates with tracking pixels look like marketing to filters.
- Admin notifications. New-order emails to the store owner use the same pipeline; if those are also missing, the pipeline is the problem, not a customer's spam filter.
Verifying it stays fixed
The transactional service's dashboard shows delivery, bounce and spam-complaint rates. A monthly glance catches a problem before customers report it. DMARC reports, once you have them, show any other source sending in your domain's name, which is how you discover the forgotten plugin or the old server still mailing.
Where this sits
Email deliverability is one of the first checks on any store we take on, because it is cheap to fix and expensive to leave, and because it is invisible from the admin: WooCommerce reports the email as sent whether or not it arrived. It is a standard part of WooCommerce work and of the monthly checks on a store's care plan.