SPF for WordPress: Email Authentication Guide

Your WordPress Contact Form Submissions Are Disappearing

Someone fills out the contact form on your WordPress site. They get a "Message sent" confirmation. You never see the email. It's not in spam — it simply never arrived. WordPress tried to send it using PHP's built-in mail() function, which has no authentication, no SPF alignment, and no credibility with receiving mail servers. For a business that depends on web leads, this is invisible revenue loss.

The WordPress Email Problem

WordPress relies on PHP's mail() function by default. This function hands the email to your web host's mail server with no authentication whatsoever. The receiving mail server sees an email claiming to be from your domain, sent from a random shared hosting IP that isn't authorized in your DNS. It fails every check.

Here's why WordPress email is uniquely problematic:

• PHP mail() provides zero authentication — no SPF, no DKIM, nothing
• Shared hosting IPs are frequently blacklisted because other sites on the same server send spam
• WooCommerce stores send critical transactional emails (order confirmations, shipping notifications) that customers expect immediately
• WordPress plugins like Contact Form 7, Gravity Forms, and WPForms all rely on the same broken mail system by default
• The fix requires two steps: routing email through a proper SMTP service, then setting up SPF for that service

How SPF Creator Helps

Setting Up SPF for WordPress

Common WordPress SPF Mistakes

Relying on PHP mail without SPF

The most common mistake is not realizing WordPress email is broken by default. PHP mail() sends from your host's IP, which almost certainly isn't in your SPF record. Even if you add the host's IP, shared hosting IPs are frequently blacklisted.

Wrong approach:

# No SMTP plugin, no SPF — emails fail silently
WordPress → PHP mail() → shared hosting IP → recipient (rejected)

Right approach:

# SMTP plugin routes through a proper service with SPF
WordPress → WP Mail SMTP → SendGrid → recipient (SPF pass)
SPF record: v=spf1 include:sendgrid.net ~all

Adding only the host IP without the email service

Some WordPress users add their web server's IP to SPF but forget that their business email (Google Workspace, Microsoft 365) also needs to be included. The result: WordPress emails pass but replies from your team inbox fail.

Wrong:

v=spf1 ip4:203.0.113.50 ~all

Right:

v=spf1 ip4:203.0.113.50 include:_spf.google.com ~all

Forgetting WooCommerce uses the same email path

WooCommerce order confirmations, shipping notifications, and refund receipts all use the same WordPress email system. If PHP mail() is broken for contact forms, it's broken for WooCommerce too. Every failed order confirmation is a potential support ticket.

Common WordPress + Service Combinations

# WordPress (SendGrid) + Google Workspace
v=spf1 include:sendgrid.net include:_spf.google.com ~all

# WordPress (Mailgun) + Google Workspace
v=spf1 include:mailgun.org include:_spf.google.com ~all

# WordPress (Amazon SES) + Microsoft 365
v=spf1 include:amazonses.com include:spf.protection.outlook.com ~all

# WordPress host IP + Google Workspace + Mailchimp
v=spf1 ip4:203.0.113.50 include:_spf.google.com include:servers.mcsv.net ~all

# WooCommerce (SendGrid) + Google Workspace + Klaviyo
v=spf1 include:sendgrid.net include:_spf.google.com include:_spf.klaviyo.com ~all

Beyond SPF, WordPress sites benefit from DKIM signing — most SMTP services like SendGrid and Mailgun support it natively. Complete the trifecta with a DMARC policy so receivers know exactly how to handle emails that fail authentication.

DNS Provider Quick Reference

Pricing

Monitor Your New SPF Record

You've created your SPF record — now make sure it keeps working. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.