How to Test Email Deliverability for a WordPress Site, and What a Passing Test Does Not Prove

This post contains affiliate links. If you buy something through one of them, Veravix may earn a commission at no extra cost to you.

You send a test email from your WordPress contact form, it arrives, and you call the job done. A week later a customer says the order confirmation never came, and when you check, the message is sitting in their spam folder. Both of those things were true at once: the test passed, and the email still did not reach the inbox.

An email deliverability test is a set of checks, and each one answers a narrower question than the name suggests. Below I separate the four tests worth running on a WordPress site, say what each one can and cannot prove, and show real data from the mail that reaches two of my own site mailboxes. I read Google’s and Microsoft’s sender rules, the mail-tester FAQ and the WordPress source on 14 October 2026.

Delivered, authenticated and in the inbox are three different results

When people say a message was “delivered”, they usually mean one of three things, and a test only ever measures one of them.

What was checked	Question it answers	Where you see it
Accepted	Did the receiving server take the message, or bounce it?	A bounce message, or the SMTP log of your mail plugin
Authenticated	Did SPF, DKIM and DMARC pass for this message?	The headers of the received message
Placed	Did it land in the inbox, a promotions tab or spam?	Only the recipient’s mailbox, or a seed-list test

A message can be accepted and authenticated and still be filed as spam, because placement also depends on the sender’s reputation and the content. That is why a single green result from one tool should be read as one data point.

Test 1: read the headers of a real message

This is the most honest test, because it uses a message your site really sent, received by a real provider. In Gmail, open the message, click More next to Reply, then choose Show original. Google’s header guide says the full header opens in a new window, and points to its Admin Toolbox Messageheader tool if you want the header analysed for you. The summary at the top lists SPF, DKIM and DMARC with a pass or fail for each. Other providers keep the same information in a header called Authentication-Results.

To see what these headers look like across ordinary mail, I read the Authentication-Results line that Hostinger’s mail server added to every message in the inbox, junk and subfolders of two site mailboxes, info@veravix.com and info@repairpicks.com, on 14 October 2026. That is 63 messages from five sending organisations. One caution before the numbers: 52 of the 63 are the same weekly newsletter, so read this as five senders, not 63 independent samples.

Sender	Messages	Domain SPF passed for	Domain DKIM signed as	DMARC result
sourceofsources.com (Mailchimp)	52	Mailchimp’s own bounce domains	sourceofsources.com	Pass, sender policy none
thesourcebottle.com (Amazon SES)	6	amazonses.com	thesourcebottle.com	No result, no DMARC record found
pinterest.com	3	pinterest.com in two, pd25.com in one	pinterest.com	Pass, sender policy reject
shopify.com	1	shopify.com	shopify.com	Pass, sender policy reject
unleashia.de	1	unleashia.de	unleashia.de	Pass, sender policy none

Three findings stand out. First, SPF and DKIM passed on all 63 messages, so “passes SPF” tells you very little on its own. Second, SPF matched the visible sender’s domain on only 4 of the 63. The newsletter sends through Mailchimp’s servers, so its SPF check passes for Mailchimp’s domain, not for sourceofsources.com. Third, DMARC still passed on 57 messages, and in 53 of them it passed on DKIM alone, because DKIM was signed with the sender’s own domain. That is what DMARC alignment means, and it is why a sender with a perfect SPF record can still fail DMARC. The failure case is explained in Email Rejected by DMARC Policy: How to Read the Bounce and Fix the Sender.

The six messages with no DMARC result came from a sender whose domain publishes no DMARC policy at all. They were still accepted, and two of them sat in the junk folder next to three other messages that passed everything. In total, 5 of the 63 were in junk despite passing SPF and DKIM. I cannot say whether the host’s filter or a manual move put each one there, but the point stands: authentication passing does not decide placement.

Test 2: a spam-score check with mail-tester

mail-tester gives you a throwaway address, you send one message to it from your site, and it returns a score out of 10. Its FAQ says you get 3 free tests in any 24 hours, that the results stay available for 7 days on the free version, and that it analyses your message, your mail server and your sending IP with SpamAssassin as its spam filter. Sending a new message to the same address replaces the earlier test.

Use it to catch obvious problems in one message, such as a missing plain-text part or a mismatched link. Do not use it to answer whether Gmail will put your mail in the inbox. A SpamAssassin score is one filter’s opinion, and the large providers run their own. The only way to measure placement without asking recipients is a seed-list tool such as GlockApps, which sends your message to real inboxes at several providers and reports where each one landed.

Test 3: Google Postmaster Tools for mail to Gmail

Postmaster Tools is the closest thing to a verdict from Gmail itself. Its dashboards cover spam rate, reputation, message authentication and delivery errors for mail sent to personal Gmail addresses. To use it you add your domain, then publish the TXT or CNAME record Google gives you at your DNS host and click Verify, which can take up to 10 minutes.

Two limits matter for a small site. It only covers Gmail and googlemail.com recipients, and Google says the dashboards can stay empty when your daily volume is too low, to protect users’ privacy. A shop sending a few dozen mails a day may verify the domain and still see nothing, which tells you nothing about whether the mail is fine.

Test 4: what WordPress itself can and cannot tell you

WordPress sends all of its mail through one function, wp_mail(), and its return value is easy to misread. The source comment on the hook that fires after a successful send states that it does not necessarily mean the recipient received the email, only that WordPress could process the request without errors. A true result means your mailer took the message. It says nothing about the inbox.

You can run the check from the command line with WP-CLI:

wp eval 'var_dump( wp_mail( "you@example.com", "Test", "Body" ) );'

If this prints bool(false), the mail never left, and the cause is on your server or in your SMTP settings. If it prints bool(true), move on to the header test above. Most SMTP plugins also include a send-a-test button that shows the connection details, which is useful for the false case. If your site relies on the host’s built-in mail function, the limits and error codes in Gmail Email Sending Limit: 500 or 2,000 a Day, and How Fast a WooCommerce Store Uses It help explain why mail can stop without a visible error.

When the rules stop being optional

For a small site, authentication is good practice. For anyone sending in volume, it is a requirement. Google’s sender guidelines, which took effect on 1 February 2024, apply SPF or DKIM, TLS, valid DNS records and a spam rate under 0.3% to everyone who sends to personal Gmail accounts. Senders of 5,000 or more messages a day to Gmail must have SPF, DKIM and DMARC, with the From domain aligned to the SPF or DKIM domain, and must support one-click unsubscribe on marketing mail. The DMARC policy is allowed to be none.

Microsoft followed for Outlook.com consumer addresses, covering hotmail.com, live.com and outlook.com. Its rules target domains sending more than 5,000 messages a day and ask for SPF, DKIM and DMARC. Third-party guides date the start to 5 May 2025, and Microsoft’s announcement says non-compliant mail goes to Junk first and may later be rejected. It does not cover Microsoft 365 business mailboxes, so check Microsoft’s current sender documentation for the exact enforcement. If you want the setup steps, How to Set Up SPF, DKIM and DMARC for Microsoft 365 Without Breaking Your Website Email walks through them.

A short routine that actually tells you something

1. Send one real message from the site, such as a password reset or a test order, to a Gmail address and an Outlook.com address you control.
2. Open the headers on each and confirm DKIM passes with your own domain, and that DMARC passes. If DMARC passes only because of DKIM, that is fine, but know which one is carrying it.
3. Run one mail-tester check to catch content problems, and fix anything it flags.
4. Check where each message landed. Inbox is the goal, and a promotions tab is normal for marketing mail.
5. Once you send enough to see data, verify the domain in Postmaster Tools and watch the spam rate.
6. Repeat the header check after any change to your DNS, your SMTP plugin or your sending service.

Sending from a proper mailbox on your own domain, with SMTP and DKIM set up, removes the most common failure, which is mail leaving through the host’s anonymous mail function. A hosting plan with business email, such as Hostinger, includes mailboxes you can authenticate that way.

Checked for accuracy on 14 October 2026 against Google’s email sender guidelines, Google’s guide to full message headers, Google’s Postmaster Tools documentation, the mail-tester FAQ, Microsoft’s announcement of its requirements for high-volume senders, and the WordPress source code for wp_mail().