Why WordPress Emails Go Missing: A Practical Guide for 2026

A contact form can look fine even when its emails never arrive.

A visitor writes a message, clicks Send, and sees a thank-you notice. Everything seems to work. But the business owner may never see that message. It could be a simple question, a booking request, or a new customer.

This is why I think email delivery deserves the same attention as website security and updates. A working form is not just a form that displays “Message sent.” It is a form that gets the message to the right place.

In this guide, I’ll show how I check WordPress email problems, from the contact form to the receiving mailbox. I’ll also explain SMTP, SPF, DKIM and DMARC in plain English.

A successful form submission is not proof of delivery

Many WordPress forms use the wp_mail() function to send messages. According to the official WordPress documentation, a successful result means the sending method accepted the request without reporting an error. It does not prove that the recipient received the email.

There is more than one step between the form and the inbox:

1. A visitor submits the form.
2. The form passes the message to WordPress or a mail service.
3. The sending server processes the message.
4. The receiving provider checks the message and decides what to do with it.
5. The message reaches the inbox, goes to spam, or is rejected.

If the first step works, the last one can still fail.

When I investigate, I want to find out where the process stops before changing any settings.

1. Start with a real contact-form test

I begin with the form visitors actually use, not just the test button inside an email plugin.

For example, imagine a WordPress website with a contact form that should send messages to a business Gmail account. I would open the website in a private browser window and send a short message with a clear subject, such as “Contact form test – 1 November.”

Then I would check three things:

• What message appeared on the website after I clicked Send?
• Did the email arrive in Gmail, including Spam and other folders?
• Was the message recorded in the form or email logs, if logging is enabled?

I also write down the time of the test. That makes it easier to find the same message in a provider’s logs later.

If nothing arrives, I do not immediately install another plugin. I check whether the form created a sending request at all.

A useful detail: the form test and the SMTP plugin’s test email are different tests. Both may be needed.

2. Check the From and Reply-To addresses

This is one of the first settings I inspect.

Suppose a visitor enters [email protected] into a form on example.com. The website should not normally send its notification as if it came directly from [email protected]. The website is not authorised to send mail for Gmail, and that can cause authentication problems.

A better setup looks like this:

• From: [email protected] — an address on the website’s own sending domain.
• To: [email protected] — the business mailbox.
• Reply-To: the visitor’s email address, after validation.

Now the website sends from its own domain, while the business owner can still reply to the visitor.

The exact fields depend on the contact-form plugin. The main point is simple: do not use someone else’s email domain as your sending identity.

3. Find out how WordPress sends email

WordPress is not a complete email delivery service. It passes messages to a mail system. Depending on the hosting setup, that may be the server’s mail function, an authenticated SMTP connection, or an email provider’s API.

A server-based setup can work. But if the host restricts outgoing mail, or the sending domain is not configured correctly, messages may fail.

An SMTP plugin can connect WordPress to a defined mail provider. Some plugins also support API connections. The important part is not the plugin name. It is knowing which service sends the messages and whether that service is configured correctly.

Before making changes, I check:

• Is an SMTP or email API plugin already active?
• Which provider sends the messages?
• Does that provider allow the configured From address?
• Are the login details and secure connection settings correct?
• Are there logs or error messages I can inspect?

For example, FluentSMTP can record sending attempts and errors. That is useful for finding problems. But a log entry marked “sent” still does not guarantee that the message reached the inbox.

I prefer one clear sending setup rather than several plugins trying to do the same job.

4. Understand SPF, DKIM and DMARC

These settings live in DNS, but they affect what happens to email sent from your domain.

I have worked with SPF, DKIM and DMARC while setting up the email infrastructure for MEND FWD. They are worth understanding because a small DNS mistake can affect more than the website contact form.

SPF: who is allowed to send?

SPF tells receiving servers which systems are authorised to send mail for a domain.

If a business uses its hosting provider, a separate mailbox service and a newsletter platform, the SPF setup must account for the relevant sending systems. Adding a new service without checking the existing record can create problems.

A domain should not have multiple competing SPF records at the same hostname. Also, SPF has a limit on DNS lookups, so adding more and more include entries is not a safe solution.

DKIM: can the message be verified?

DKIM adds a digital signature to outgoing messages. The receiving server checks that signature using a public key stored in DNS.

The email provider normally gives you the DKIM record to publish. I use the exact record supplied for that domain and account, not an example copied from a tutorial.

DMARC: does the sender identity match?

DMARC checks whether SPF or DKIM passes in a way that matches the domain shown in the message’s From address. It also allows a domain owner to publish a policy and receive reports.

This explains why seeing “SPF: PASS” is not always enough. The authenticated domain also needs to align with the visible sender, unless aligned DKIM passes.

For a new setup, monitoring results before moving to a strict DMARC policy is often safer. A strict policy applied too early can interfere with legitimate email from a service you forgot to include.

Google’s Gmail requirements are also useful here. All senders to personal Gmail accounts must meet baseline authentication requirements, including SPF or DKIM. Higher-volume senders have additional requirements, including SPF, DKIM and DMARC. I prefer setting up all three correctly even for a small business domain.

Do not copy DNS records blindly. The correct values depend on your actual email providers.

5. Check what happened to the message

Once I know the form is sending, I follow the message further.

I send one test through the email plugin, then another through the public contact form. If possible, I test delivery to two different mailbox providers.

For a Gmail recipient, I can open a delivered test message and use Show original to inspect its authentication results. I look for SPF, DKIM and DMARC, and I check whether the sender domain is what I expected.

If the email does not arrive, I check the sending provider’s delivery events and error messages, if available. A message may have been rejected, deferred or accepted for delivery. Those are not the same result.

I also check spam folders, forwarding rules and mailbox filters. Sometimes the message arrived, but not where the owner expected it.

Finally, I click Reply on a test notification. The reply should go to the person who submitted the form, not back to the website’s automated sending address.

This end-to-end test tells me more than a green success notice.

6. Keep useful logs, but protect private messages

Email logs can save time during troubleshooting. They can show when WordPress tried to send a message and what error the provider returned.

But contact forms often contain personal information: names, email addresses, phone numbers and private questions.

For that reason, I do not treat logging as an excuse to store every message forever. Access should be limited, and the retention period should fit the business need. When possible, I keep the information needed to diagnose delivery without keeping full message content longer than necessary.

For websites serving people in the EU, this also supports basic GDPR principles such as data minimisation and storage limitation.

Quick checks when WordPress emails stop arriving

What happens	What I check
The form shows an error	Form settings, validation, spam protection and plugin errors.
The form says “sent,” but no mail log appears	Whether the form uses the expected sending method and whether logging is enabled.
The mail plugin shows an authentication error	Provider credentials, sender address and provider response.
The provider accepted the email, but it is not in the inbox	Spam folders, filters, delivery events and possible bounces.
SPF passes, but DMARC fails	Whether SPF or DKIM aligns with the visible From domain.
Email stopped after a website migration	DNS records, mail provider settings, credentials and hosting restrictions.

These checks help narrow down the problem. The exact error message still matters more than any general checklist.

Three mistakes I avoid

Changing several things at once. If I replace the mail plugin, edit DNS and change the form settings in one session, it becomes difficult to know what fixed the problem — or what broke it.

Using a visitor’s email as From. The visitor’s address belongs in Reply-To. The website should send from a domain it is authorised to use.

Assuming one successful test solves everything. A test shows what worked at that moment. I still want a simple way to notice failures after future hosting, DNS or plugin changes.

Frequently asked questions

Why does WordPress say my message was sent when no email arrives?

The form may have accepted the submission without the message reaching the recipient. Check the mail logs, provider events and receiving mailbox to find where it stopped.

Do I always need an SMTP plugin?

No. A properly configured hosting mail system can work. SMTP or an email API becomes useful when you need a defined sending service and better control or diagnostics.

Will SPF, DKIM and DMARC keep all emails out of spam?

No. They help verify the sender and protect against impersonation, but mailbox providers also consider reputation and other signals. Authentication improves the setup; it does not promise inbox placement.

Should I set DMARC to p=reject immediately?

Not before checking all the services that send mail for your domain. First confirm that legitimate messages pass authentication and alignment, then choose a policy based on the results.

A contact form should be tested like any other business tool

If a website collects enquiries, email delivery is part of the website’s job.

My approach is to follow the message from start to finish: contact form → WordPress → sending service → receiving mailbox. I look for evidence at each step, change one thing at a time, and test again.

The same careful approach matters when maintaining a live website. In my earlier guide, How to Update WordPress Safely in 2026, I explain why backups and testing are part of a safer update process.

Need help checking your WordPress email setup? At MEND FWD, I work on WordPress maintenance, security and practical troubleshooting. I can help review your contact form, sending settings and domain authentication, then test what actually works.

Sources and further reading

• WordPress Developer Resources — wp_mail()
• Google — Email sender guidelines
• Cloudflare — Email security records
• Cloudflare — Troubleshooting email issues