WordPress form emails vanish because wp_mail() hands your message to unauthenticated PHP mail. Here's the WordPress SMTP setup that makes them land — and the test that proves it.
A roofing contractor I know found out he'd been losing quote requests for eleven weeks. Not because the form was broken — Contact Form 7 kept painting that green "Thank you for your message. It has been sent." bar on every submission. The mail just went nowhere, because there was no WordPress SMTP configuration behind it. His shared host had quietly disabled the local sendmail binary after a compromised plugin on a neighbouring account started blasting spam, and WordPress swallowed the failure without a single log line.
Eleven weeks. On a site whose entire job was collecting quote requests.
Here's the thing about wp_mail(). By default it hands your message to PHP's mail() function, which hands it to whatever MTA the host happens to run, which sends from a shared IP with no DKIM signature, no SPF-aligned envelope sender, and a From: address like wordpress@yourdomain.com that has never existed as a real mailbox. Gmail sees an unsigned message claiming to be your domain, arriving from a /24 packed with other WordPress installs. It junks it. Or drops it silently at the edge, which is worse — at least spam has a folder.
An SMTP relay fixes this by making WordPress log in as a real mailbox and send through a server that signs on your behalf.
By the end of this you'll have WordPress authenticating against a JustEmails mailbox over TLS on port 587, sending from your own domain with SPF, DKIM, and DMARC all passing. Contact form notifications, password resets, WooCommerce order confirmations, plugin update warnings — all of it goes out over the same authenticated path. Credentials live in wp-config.php rather than the database. And you'll have a way to prove it worked that doesn't rely on the plugin's own "test email sent successfully" screen.
That screen, by the way, is close to useless. It confirms the TCP handshake and the AUTH exchange. It tells you nothing about whether Gmail kept the message.
I trusted that green bar for two years before I read a single message header. Which is about two years longer than I'd like to put in writing.
wp-config.php onceOne note on the JustEmails side: there's only the one plan — $49/year — and mailboxes are unlimited on it, so spinning up a dedicated one for WordPress costs nothing extra. Do that. Don't point your site at the mailbox you actually read.
In the JustEmails dashboard, pick your domain and create a mailbox — forms@yourdomain.com works, so does notifications@. Generate a long random password and copy it somewhere safe for the next four minutes.
Why a dedicated mailbox rather than reusing hello@? When you rotate the password (and you will, the day a contractor pastes wp-config.php into a support ticket), you only break WordPress. Automated sending reputation stays separate from the mail you type by hand. And every auth failure lands in one mailbox's logs, so "is the site failing to send?" gets an answer instead of a shrug.
Skip no-reply@ while you're here. People reply to form notifications constantly, usually to forward them internally, and bouncing those replies is a self-inflicted wound.
Plugins → Add New → search "WP Mail SMTP" (the one by WP Mail SMTP, formerly WPForms). Install, activate, skip the setup wizard — it pushes you toward the hosted mailers and we're going somewhere else.
The free version has everything this needs. You do not need Pro to point WordPress at your own SMTP server, whatever the upgrade banner implies.
And it does imply it. Loudly. Burying Other SMTP under a wall of logos for mailers that want your card on file is, honestly, the most user-hostile UX in the plugin directory right now, and it costs beginners hours.
FluentSMTP and Post SMTP do the same job, and FluentSMTP is genuinely nicer for per-plugin routing. I'm using WP Mail SMTP here because it's on millions of sites and the screenshots in every support thread match it.
Go to WP Mail SMTP → Settings, choose Other SMTP as the mailer, and fill in:
| Field | Value |
|---|---|
| From Email | forms@yourdomain.com |
| Force From Email | On |
| From Name | Your business name |
| Force From Name | Off (let plugins set their own) |
| SMTP Host | smtp.justemails.app |
| Encryption | TLS |
| SMTP Port | 587 |
| Auto TLS | On |
| Authentication | On |
| SMTP Username | forms@yourdomain.com |
| SMTP Password | the mailbox password from Step 1 |
Force From Email is the setting that matters most here. Plugins love to set their own From: header — Contact Form 7 defaults to the visitor's address, WooCommerce uses whatever's in its own settings, and half the form builders on the market do something in between. If the header says visitor@gmail.com but you authenticated as forms@yourdomain.com, DMARC alignment fails and you've done all this work for nothing. Forcing the From address stops that at the source.
Port 587 with STARTTLS is the default for a reason. If your host blocks it, 465 with SSL selected as the encryption is a fine substitute — we broke down the differences in email ports explained. Port 25 isn't a fallback, it's a dead end.
The username is the full email address. Not forms. I have watched experienced admins lose twenty minutes to this exact thing — and by "experienced admins" I mean me, last spring, on my own domain, with the docs open in the next tab.
WP Mail SMTP will happily store that password in wp_options, in plaintext, where every database backup and every plugin with $wpdb access can read it. Don't leave it there.
Open wp-config.php and add this above the /* That's all, stop editing! */ line:
define( 'WPMS_ON', true );
define( 'WPMS_MAILER', 'smtp' );
define( 'WPMS_SMTP_HOST', 'smtp.justemails.app' );
define( 'WPMS_SMTP_PORT', 587 );
define( 'WPMS_SSL', 'tls' );
define( 'WPMS_SMTP_AUTH', true );
define( 'WPMS_SMTP_USER', 'forms@yourdomain.com' );
define( 'WPMS_SMTP_PASS', 'your-mailbox-password-here' );
define( 'WPMS_MAIL_FROM', 'forms@yourdomain.com' );
define( 'WPMS_MAIL_FROM_FORCE', true );
Save, reload the settings page, and those fields go grey with a small "set in wp-config.php" note next to them. That's the constant winning. Now clear the password out of the plugin's own field so it isn't sitting in two places.
Is a constant in wp-config.php real secret management? No. Anyone with file access still reads it. But it's out of the database, out of your nightly SQL dumps, and out of reach of a plugin that gets popped — which covers the realistic threats by a wide margin.
WP Mail SMTP → Tools → Email Test. Send one to a Gmail address you control. If you've got WP-CLI, this is the more honest test because it goes through wp_mail() the same way a plugin would:
wp eval "var_dump( wp_mail( 'you@gmail.com', 'SMTP relay test', 'If you can read this, wp_mail() is authenticated.' ) );"
bool(true) means WordPress handed it off cleanly. Then go and open the message in Gmail, hit the three dots, and choose Show original. You want three lines:
SPF: PASS with IP ...
DKIM: PASS with domain yourdomain.com
DMARC: PASS
All three. Not two. A DKIM PASS on a domain that isn't yours means something is signing on behalf of a relay rather than your domain, and DMARC will fail alignment even though nothing looks obviously wrong.
Then send a real submission through your actual contact form. The plugin's test path and the form's path are different code, and I have seen the first pass while the second quietly failed on a From: header override.
I once handed a client site over on the strength of a green test screen. Found out three days later. Test the thing you actually care about, not the thing the plugin offers to test for you.
JustEmails auto-configures SPF, DKIM, DMARC, and MTA-STS when you add a domain, so Step 5 usually passes on the first attempt. What's worth doing next is checking the policy you're publishing.
Send a test to mail-tester.com and read the breakdown — 9/10 or better is where you want to be, and the deductions are specific enough to act on. If your DMARC record still sits at p=none, it's reporting but not protecting. Which is fine for a month while you read the reports. Sitting at p=none for two years — and plenty of agencies do, because nobody wants to be the person who broke the client's newsletter — is a policy-shaped decoration, and I'd rather you knew that now. Our walkthrough on moving DMARC from p=none to p=reject covers the ramp without nuking your legitimate mail.
One annoying side effect: authenticated SMTP means bot form submissions now arrive reliably too. If you're running paid traffic to those forms, ClickzProtect handles that filtering problem.
SMTP Error: Could not authenticate.
The 535 response. Nine times out of ten the username is forms instead of forms@yourdomain.com. Otherwise it's a trailing space on a copy-pasted password, or a password you rotated in the dashboard and forgot to update in wp-config.php.
SMTP connect() failed. https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting
The connection never opened. Check outbound 587 from the server itself:
nc -zv smtp.justemails.app 587
Timeout means your host blocks it. Ask them to open it, or switch to 465. Budget shared hosts sometimes refuse both and push you toward their own relay — that's usually the moment to change hosts.
stream_socket_enable_crypto(): SSL operation failed ... certificate verify failed
The server's CA bundle is stale or openssl.cafile isn't set in php.ini. Update ca-certificates at the OS level. Every "fix" you'll find on Stack Overflow involving verify_peer => false disables the only part of TLS that proves you're talking to the right server. Don't.
Mail sends, but arrives in spam
Almost always a From: mismatch. Confirm Force From Email is on, then check that the plugin generating the mail isn't setting its own headers at a later filter priority. WooCommerce and most form builders both do.
Mail sends from the test tool, nothing from the form
Different code path. Check whether the form plugin has its own SMTP or "sender" settings overriding wp_mail(), and whether a caching or security plugin is short-circuiting admin-ajax. Symptom-wise it looks a lot like the stuck-outbox problem on desktop clients — same root cause family, different surface.
Everything worked for three weeks, then stopped
Check whether someone rotated the mailbox password, or whether a wp-config.php change got overwritten by a host-managed deploy. Managed WordPress hosts are the usual culprit — they rewrite that file more often than anyone expects.
I lost an afternoon to one host that quietly restored wp-config.php from a "known good" snapshot every time its security scanner fired: no notification, no log entry, nothing in the dashboard to turn it off. Support told me to whitelist the file. There is no whitelist.
SMTP is the right tool for WordPress because it needs zero code and every plugin already speaks it. Once your volume grows past a few hundred messages a day, or you want delivery webhooks and message logs instead of guessing, the API path is worth a look — we compared the two in SMTP vs API for transactional email. The same $49/year includes 1,000 transactional API emails a month, so you can test it without adding a line item.
A few other things worth doing while you're in here:
And put a calendar reminder six months out to send yourself one test submission. It takes eleven seconds. Ask the roofing contractor what eleven weeks of silence cost.
In most cases WordPress isn't using SMTP at all — wp_mail() falls back to PHP's mail() function, which hands the message to a local sendmail binary that many shared hosts have disabled or rate-limited. Even when it does send, the message carries no DKIM signature and no SPF-aligned envelope sender, so Gmail and Outlook filter it. Installing an SMTP plugin and pointing it at an authenticated mailbox on your own domain fixes both problems at once.
No. The free version of WP Mail SMTP includes the Other SMTP mailer, which is all you need for host, port, encryption, and username/password authentication. The Pro tier adds email logging, multi-mailer failover, and managed setup. Email logging is genuinely useful for debugging form submissions, but it isn't required to get mail flowing — start free and upgrade only if you actually want the log.
Use 587 with STARTTLS unless something on your host blocks it, then fall back to 465 with implicit SSL. Both are encrypted and both are fine. Port 25 is not an option — nearly every shared host and cloud provider blocks outbound 25 to stop spam, and if it does connect it usually connects unencrypted.
Usually because the From address doesn't match the mailbox you authenticated with. Contact Form 7 lets you set a From header per form, and if that header says the visitor's own address while you authenticated as forms@yourdomain.com, DMARC alignment fails. Set the From to your own domain, put the visitor's address in Reply-To, and turn on Force From Email in WP Mail SMTP so nothing can override it.
Unlimited custom domain email hosting for $49/year flat — unlimited domains, unlimited mailboxes, 10 GB storage, full IMAP/SMTP. Built for agencies, freelancers, and anyone managing email across more than one domain.
Start your 7-day free trial → · How it compares · Part of Velocity Digital Labs