E-commerce Order Email Deliverability: Why Confirmations Go Missing

An order confirmation is the one email every customer expects within a minute of paying. When it lands in spam, or never arrives, the customer assumes the order failed, opens a support ticket, disputes the charge or orders again. Order emails are transactional messages, and the rules for getting them delivered are mostly about proving that you are allowed to send as your domain. This guide covers the authentication records, how common platforms send, how to test, and how to notice a problem before customers do.

How order emails travel

Whatever platform you use, an order email follows the same path:

1. The store generates the message when an event happens (order placed, paid, shipped).
2. It hands the message to a sending service: the platform's own mail system, your web server's mail function, or a transactional email provider such as an SMTP relay or API-based sender.
3. The receiving mailbox provider checks who sent it and whether the sending server is authorized to use the domain in the From address.
4. It decides: inbox, spam folder or reject.

Step 3 relies on three DNS standards, explained in depth in SPF, DKIM and DMARC: the complete guide.

• SPF lists which servers may send for your domain.
• DKIM adds a cryptographic signature that the receiver checks against a public key in your DNS.
• DMARC tells receivers what to do when SPF and DKIM do not align with the From domain, and where to send reports.

Mailbox providers have for some years required or strongly encouraged bulk senders to authenticate this way, and large providers publish sender guidelines you should read for your own volume. Even for small senders, a missing or failing check is the first thing to rule out.

Step 1: Decide which address and domain you send from

Use an address on a domain you own, such as orders@yourstore.com, not a free mailbox address like a Gmail one. Receivers reject or spam-folder mail that claims to be from a free provider but is sent by another server, because the free provider's DMARC policy does not authorize your sender.

Do not send transactional mail from your store's primary domain if you also run marketing from it without a plan. Many stores use a subdomain for transactional mail (for example mail.yourstore.com or orders.yourstore.com) and another for newsletters, so a reputation problem in marketing does not hurt order emails. Transactional email DNS checklist goes deeper.

Step 2: Authenticate the sending service

Shopify

Shopify sends order notifications on your behalf. Shopify's admin allows you to set a sender email under notification settings, and its documentation describes how to authenticate your domain so that those emails are signed for your domain. The exact records and steps appear in your admin and in the Help Center, so follow the values displayed there and do not copy records from third-party articles. If you use an email provider such as Google Workspace or Microsoft 365 for staff mail, make sure the SPF record includes every service that sends for the domain, in one record. Google Workspace DNS records and Microsoft 365 DNS records list the standard entries.

WooCommerce and other self-hosted stores

By default, WordPress sends mail through the PHP mail function of the web server, often from an address and IP that you do not control. That is the single most common cause of missing WooCommerce order emails. The fix:

1. Choose a transactional email service or your mailbox provider's SMTP relay.
2. Install an SMTP plugin (or use the service's own plugin) and send all mail through authenticated SMTP or an API.
3. Add the DNS records the provider tells you to add, usually a DKIM key (as CNAME or TXT records) and an SPF include.
4. Set the From address in WooCommerce, Settings, Emails, to an address on the authenticated domain.
5. Send a test and inspect the message headers (see below).

See WordPress email not sending fix for plugin-level troubleshooting.

Step 3: Check your DNS records

Use these checks, each from outside your network:

dig +short TXT example.com | grep -i spf
dig +short TXT _dmarc.example.com
dig +short TXT selector._domainkey.example.com

The DKIM selector (selector above) is given by your provider. Look for:

• One SPF record only. Two SPF TXT records on the same name cause a permanent error. Merge them into one. Check the 10-lookup limit with the SPF Record Checker; if you exceed it, see fixing too many DNS lookups in SPF.
• A valid DKIM public key at the exact name your provider specifies.
• A DMARC record beginning with v=DMARC1. Start with p=none and a reporting address so you can see who sends as your domain before enforcing. DMARC rollout from none to reject explains a safe path. The SPF and DMARC Generator can draft records.
• Matching MX records if you receive replies; verify them with the MX Lookup.

The Email DNS Checker runs several of these tests together.

Step 4: Send a test and read the headers

Place a real test order using an address at a major mailbox provider, and view the original message source. Find the Authentication-Results header and look for:

spf=pass
dkim=pass header.d=yourstore.com
dmarc=pass

If DKIM passes but with a different domain (for example the sending service's domain), DMARC alignment may fail. The signing domain should match, or be a subdomain of, your From domain. Pass results across SPF, DKIM and DMARC mean the technical groundwork is right. The Email Deliverability Test can analyze a test message for you.

Test with several providers, because each has its own filters, and test messages containing realistic order content, since content influences filtering as well.

Step 5: Keep reputation clean

• Check blocklists. If the sending IP or domain is listed, mail is rejected or spammed. Use the Blacklist Checker and follow email blacklist removal if needed.
• Use a dedicated service with a good reputation instead of a shared web server IP. Shared hosting IPs can be abused by neighbors.
• Warm up new domains or IPs by increasing volume gradually; see email warmup for a new domain.
• Keep transactional and marketing separate, as above.
• Keep bounce rates low. Validate addresses at checkout (typos like gmial.com are common) and suppress addresses that hard bounce. Email bounce codes explained helps interpret the responses.
• Avoid spammy templates. Order emails should be plain, clear and relevant: order number, items, total and a support address. Heavy image-only layouts and tracking redirect links that look like phishing can hurt.
• Reverse DNS matters if you run your own mail server; see reverse DNS and PTR for email. Most stores should not run their own mail server.

Common failure patterns

Monitor email, not just the website

A site can be fully up while email is broken. Build simple tripwires:

• Heartbeat on the email job. If order emails go out through a queue or scheduled task, ping a heartbeat monitor when the queue is processed and alert if it stops. See cron job heartbeat monitoring.
• Seed address. Place a test order weekly using a test mailbox and confirm arrival.
• DMARC reports. Read the aggregate reports to see new, unexpected senders.
• DNS watch. Changes to SPF, DKIM or MX records can silently break mail. Monitoring for DNS changes with the uptime monitor alerts you when records are altered.

Next steps

• Test a sample message with the Email Deliverability Test.
• Validate SPF with the SPF Record Checker and all records with the Email DNS Checker.
• Draft records with the SPF and DMARC Generator.
• Read the SPF, DKIM and DMARC guide.
• Fix listing problems with the Blacklist Checker.

FAQ

Why do my order confirmation emails go to spam?

The most common causes are missing DKIM, a failing DMARC check, mail sent through an unauthenticated web server, or a From address on a free mailbox domain. Check the message headers for the SPF, DKIM and DMARC results.

Do I need DMARC for a small store?

It is a good idea. It protects your domain from being spoofed and gives you reports on who sends mail as you. Start with a monitoring-only policy and tighten later.

Should order emails come from the same domain as marketing emails?

Preferably from a separate subdomain. A reputation problem caused by a campaign should not affect receipts that customers are waiting for.

Why does WooCommerce not send emails?

WordPress uses the server's mail function by default, which is often disabled or poorly trusted. Configure authenticated SMTP or a transactional email service and set the From address on a domain you have authenticated.

How can I tell when order emails stop?

Use a heartbeat on the sending queue, a weekly test order to a seed mailbox, and DMARC reports. Do not rely on customers to tell you.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.