Your WooCommerce order emails are going to spam. Here is the fix
Why WooCommerce order confirmations land in spam, how to confirm the diagnosis in Gmail in one minute, and the two-part fix that ends it: a real sending service plus the DNS records that prove your domain.
Your store takes an order, WooCommerce fires the confirmation email, and the customer finds it three days later in spam, next to a message about inheritance funds. Then they email you asking whether their order went through, and you answer order emails by hand for a shop that was supposed to be automated. Here is why it happens and the fix, in the order to try it.
Why store emails go to spam
Out of the box, WordPress sends email through the PHP mail function on your hosting server. That means your order confirmations come from the same shared server, and often the same IP address, as every other site on that host, including the hacked ones sending actual spam. Gmail does not judge your store; it judges the server, and the server’s record is terrible.
Worse, the message claims to be from yourstore.com while nothing proves the hosting server is allowed to say that. Mail providers check exactly that claim, and unproven claims are what the spam folder is for.
First, confirm the diagnosis
Place a test order with a Gmail address you own.
Open the email, click the three dots, choose "Show original".
Look at the three verdicts at the top: SPF, DKIM, DMARC.
If any of them says FAIL, or the DKIM line signs a domain that is not yours, you have found the problem. If all three pass and mail still lands in spam, your problem is the shared server’s reputation, and the fix below solves that too, because it moves your mail off that server entirely.
The fix: stop sending from your web host
Web hosts are built to serve pages, not to deliver mail. The durable fix has two halves, and both are one-time work.
Half one: send through a real email service
Install an SMTP plugin, or a plugin from an email provider, so WooCommerce hands its emails to a service whose whole job is delivery. Every order email then leaves from infrastructure with a reputation worth protecting, instead of from your web server.
Half two: publish the DNS records that prove it
The provider will give you a short list of DNS records, usually called SPF, DKIM, and sometimes DMARC or MAIL FROM. These are the proofs Gmail was looking for in the diagnosis step. You add them once at your domain registrar, the provider verifies them, and from then on your store’s emails carry evidence instead of claims. If those names are new to you, we wrote a plain-English guide: SPF, DKIM, DMARC, and MX explained.
Three WooCommerce-specific checks
The From address in WooCommerce settings must be on YOUR domain. A store sending from a personal Gmail address fails authentication by design; providers forbid impersonating gmail.com.
Send order emails from a subdomain like
mail.yourstore.com, so a future newsletter mistake on the main domain never drags receipts into spam with it.Do not stop at the customer emails. The admin new-order notification travels the same road, and a store owner who stops receiving those finds out via an angry customer.
How to know it worked
Repeat the diagnosis: a fresh test order, "Show original", three verdicts. You want SPF PASS, DKIM PASS with your own domain in the signature, and DMARC PASS. Then watch the next week of real orders; the "did my order go through" support emails stop almost immediately, which is the metric that actually matters.
