Skip to content
aivoma
en
Free check

Fix guides · Trust & email

Your order confirmations are landing in spam

Missing SPF, DKIM or DMARC records make WooCommerce order confirmations, password resets and shipping updates go to spam — and let anyone spoof your shop. DNS records and SMTP setup that fix it.

Impact: High We fix this in AI Visibility Monitoring — €79 · Updated

The symptom

  1. Customers say they never received the order confirmation; support asks "did my order go through?".
  2. Gmail shows a red "?" avatar or "be careful with this message" on your emails.
  3. DNS has no v=spf1 TXT record, no _dmarc record, or WooCommerce sends via PHP mail() from the web server.

Why it matters

Since 2024 Gmail, Yahoo and Outlook require SPF and DKIM alignment plus a DMARC policy for bulk senders and increasingly for everyone. Unauthenticated mail is filtered or rejected. A shop whose confirmations vanish loses repeat customers and gets chargebacks.

Without DMARC, anyone can send mail "from" your shop domain — phishing your customers with your brand.

How to check it yourself

  1. Look up TXT records for your domain and _dmarc.yourdomain: e.g. dig TXT yourstore.com and dig TXT _dmarc.yourstore.com, or use MXToolbox.
  2. Send a test order to a Gmail address and open *Show original*: SPF, DKIM and DMARC should each say PASS.
  3. The free Aivoma check reads your SPF and DMARC records live.

How to fix it

  1. Send through an authenticated SMTP or API service (Brevo, Postmark, Amazon SES, Mailgun, or your mail provider) using WP Mail SMTP or FluentSMTP — never PHP mail() from the web host.
  2. SPF: one TXT record on the root domain listing every sender, e.g. v=spf1 include:spf.brevo.com include:_spf.google.com ~all. Only one SPF record is allowed; max 10 lookups.
  3. DKIM: add the CNAME/TXT keys the service gives you; enable signing for the exact From domain used in WooCommerce → Settings → Emails.
  4. DMARC: start with v=DMARC1; p=none; rua=mailto:[email protected], review reports for two weeks, then move to p=quarantine and finally p=reject.
  5. Set the WooCommerce "From" address to the authenticated domain (not gmail.com), and add a reply-to that is monitored.

FAQ

Straight answers to the questions store owners ask

My host says email works fine.

It sends; the question is whether it is delivered. Authentication is checked by the recipient, not the sender.

DMARC p=none — is that enough?

It is a monitoring step only. Spoofed mail is still delivered until you move to quarantine or reject.

Free instant store check

See what AI assistants can read on your store — in 60 seconds

Paste your store URL. We test AI-crawler access, product schema, prices, GTINs, feeds and email security live, and show the exact gaps. No sign-up, no obligation.

Check my store free