Why Your Website Email Lands in Spam — And How to Fix It
Website email going to spam is one of the most common — and most damaging — problems a small business can have. A contact form submission, a WooCommerce order confirmation, or a password reset email silently disappears into a spam folder. The customer never sees it. You never know.
This guide explains exactly why it happens and what you can do to fix it permanently.
The Core Problem: PHP Mail Is Not a Mail Server
Most shared hosting plans send email through PHP’s mail() function or a basic sendmail relay baked into the server. This is not a proper mail server — it is a shortcut.
Gmail, Outlook, and Yahoo judge incoming mail by asking: “Can I verify where this came from?” When your website sends mail through a generic server IP with no authentication records attached to your domain, the answer is no — and the email goes straight to spam.
This is not a bug in your code. It is a structural problem with how the email is being sent.
The Five Reasons Website Email Fails Authentication
1. Missing or Broken SPF Record
SPF (Sender Policy Framework) is a DNS record that lists which servers are allowed to send mail on behalf of your domain. If your hosting server’s IP is not listed in your SPF record — or if you have no SPF record at all — receiving servers treat your email as unauthorised.
Fixing it: Add a TXT record to your DNS zone. A basic SPF record looks like:
v=spf1 ip4:YOUR.SERVER.IP include:_spf.yoursmtpprovider.com ~all
2. No DKIM Signature
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outbound email. The receiving server checks that signature against a public key in your DNS. If there is no key — or the signature is missing — spam filters distrust the message.
PHP mail() does not sign emails. You need either a proper mail server or an SMTP relay that signs on your behalf.
3. No DMARC Policy
DMARC tells receiving servers what to do when SPF and DKIM checks fail. Without a DMARC record, Gmail and others have no policy to enforce, which makes your domain look unmanaged. Modern spam filters penalise domains with no DMARC.
A minimal DMARC record:
v=DMARC1; p=none; rua=mailto:[email protected]
Start with p=none (monitoring only), then move to p=quarantine or p=reject once your SPF and DKIM are confirmed working.
4. Shared IP Reputation
On cheap shared hosting, your website shares a server IP with dozens or hundreds of other sites. If any of those sites sends spam, the IP gets blacklisted — and your legitimate email gets blocked along with it. You have no control over this.
5. PHP Mail Sends From the Wrong “From” Address
Many WordPress sites send email with a From: header like [email protected] or even nobody@localhost. This does not match any authenticated sending identity. Spam filters flag it immediately.
The fix: install an SMTP plugin (WP Mail SMTP is the standard choice) and route all outbound email through a verified SMTP account.
The Real Fix: Route Website Email Through Authenticated SMTP
The permanent solution is simple in principle: stop using PHP mail and start using authenticated SMTP.
Here is how to do it for a WordPress site:
- Install WP Mail SMTP (free plugin).
- Set it to use your business email credentials — SMTP host, port 587 (STARTTLS), your email address, and your password.
- Send a test email from the plugin and verify it arrives in the inbox.
- Check your SPF record includes the mail server you are now routing through.
For non-WordPress apps (Node.js, Python, Laravel), use a mail library like Nodemailer, smtplib, or Symfony Mailer configured with SMTP credentials rather than local sendmail.
Why a Separate Business Email Subscription Matters
The SMTP credentials you use must belong to a real, authenticated mail server — not a free Gmail account (which has sending limits and flags commercial use) and not a generic hosting relay.
CM Cloud Business Email gives you a dedicated mailbox at your domain with full SPF, DKIM, and DMARC support out of the box. You get authenticated SMTP credentials you can plug straight into WP Mail SMTP or any mail library.
Important: Business Email is sold separately from web hosting. It is not included in Shared Hosting or Managed WordPress plans. If you want your website to send authenticated email, you need a Business Email subscription in addition to your hosting plan.
See cmcloudhosting.com/pricing for current plan pricing.
CM Cloud Business Email vs Competitors
| Provider | Starter Price (USD) | XAF | EUR | Key Feature |
|---|---|---|---|---|
| CM Cloud | $1.99/user/mo | XAF 1,250 | €1.85 | Full SPF/DKIM/DMARC, SMTP credentials included |
| Google Workspace | $6.00/user/mo | ~XAF 3,750 | ~€5.55 | Gmail interface, strong deliverability |
| Microsoft 365 Business Basic | $6.00/user/mo | ~XAF 3,750 | ~€5.55 | Outlook, Teams bundled |
| Zoho Mail Lite | $1.00/user/mo | ~XAF 625 | ~€0.93 | Limited SMTP relay, storage capped |
CM Cloud is the most affordable option that gives you the SMTP infrastructure and DNS records needed to fix deliverability at the source.
Optional: Enforce a Consistent Signature on Every Outbound Email
Once your deliverability is fixed, consider the Email Signatures add-on ($0.99/mo per domain — not per mailbox). It stamps a branded HTML signature onto every outbound email at the mail server level, so it applies across every device and mail client with nothing to install.
This is relevant here because the signature is applied before DKIM signing, so the signature does not break authentication or cause deliverability issues. Your email arrives branded and authenticated.
Unlike competitors such as CodeTwo or Exclaimer who charge per mailbox, CM Cloud charges one flat rate for the whole domain regardless of how many staff you have.
What About the “From” Address on Contact Forms?
A common misconfiguration in WordPress and PHP contact forms: the From: header is set to the visitor’s email address (the person filling the form). This causes SPF to fail because your server is claiming to send on behalf of a random Gmail or Yahoo address it has no authority over.
Fix: Always set the From: address to a mailbox you control at your own domain (e.g. [email protected]). Use Reply-To: for the visitor’s address. Most form plugins (WPForms, Contact Form 7) have explicit fields for this.
Quick Diagnostic Checklist
Run these checks before anything else:
- MXToolbox SPF Check — verify your SPF record is valid and includes your sending IP.
- MXToolbox DKIM Lookup — confirm a public DKIM key exists for your domain.
- Google Postmaster Tools — monitor your domain’s spam rate and reputation over time.
- Mail-tester.com — send a test email and get a deliverability score out of 10.
- SMTP test in WP Mail SMTP — confirm WordPress is routing mail through authenticated SMTP and not PHP mail.
A score of 8 or above on Mail-tester indicates your deliverability setup is solid.
Pricing Summary
| CM Cloud Product | USD | XAF | EUR |
|---|---|---|---|
| Business Email (per user) | $1.99/mo | XAF 1,250 | €1.85 |
| Business Email Bundle (5 mailboxes) | $4.99/mo | XAF 3,000 | €4.60 |
| Email Signatures add-on (per domain) | $0.99/mo | XAF 600 | €0.89 |
| Shared Hosting Starter | $3.99/mo | XAF 2,500 | €3.70 |
| Managed WordPress Starter | $6.99/mo | XAF 4,500 | €6.50 |
Note: Shared Hosting and Managed WordPress do not include business email. Email Hosting is a separate subscription. Visit cmcloudhosting.com/pricing for the full breakdown.
Summary
Website email lands in spam because PHP mail does not authenticate. The fix requires three things working together: a valid SPF record, DKIM signing via a real mail server, and DMARC for policy enforcement. Route your WordPress or app email through authenticated SMTP using a Business Email account, correct your From: headers in contact forms, and your deliverability problem is solved at the root.
Fix Your Website Email Deliverability Today
Get a CM Cloud Business Email subscription from $1.99/user/month (XAF 1,250 / €1.85). Plug the SMTP credentials into WP Mail SMTP or your app’s mail library. SPF, DKIM, and DMARC records are supported from day one.