The WordPress wp_mail() function creates a message and delivers it to the server's email infrastructure; a successful return does not necessarily mean the recipient has received the message. Form, password reset, and WooCommerce email applications should be examined separately, including SMTP, DNS authentication, and delivery logs.
wp_mail returned true but message not received
SMTP Error: Could not authenticate
Connection timed out on port 587
550 SPF/DKIM validation failed
The issue can occur in one of three layers: WordPress does not generate a message, the SMTP/MTA does not accept the message, or the remote recipient rejects or marks the message as spam. Each layer requires different logs and tests.
Contact Form 7 or WooCommerce may display a 'sent' message, but this is no guarantee of delivery. The wp_mail_failed hook, SMTP log, and server mail log should be examined together
The from address should be compatible with the site domain; using a random Gmail address as From may break SPF/DMARC alignment. Visitor address should be used in the Reply-To field.
Port 25 may be blocked by the data center; authenticated SMTP typically uses 587 STARTTLS or 465 TLS. The correct host, port and encryption values provided by the provider should be used.
SPF, DKIM, DMARC, and PTR/rDNS determine the reliability of mail delivery. Even if DNS records are correct, the sender IP may be blacklisted or the domain reputation may be low.
Instead of storing your SMTP password in plain text in wp-config.php or the plugin database, use the environment/secret method whenever possible and use a limited-access application password.
Search for the phrase you see in the email, browser, or SSH log. Each card includes meaning, probable cause, and safe initial action.
Meaning: WordPress/PHPMailer failed to deliver the message to the mail layer.
Possible cause: Invalid address, hook error or mailer issue.
Meaning: Has accepted the local mail message but delivery has not been verified.
Possible cause: Spam, remote deny, DNS signature or queue.
Meaning: The SMTP server has refused the username/password.
Possible cause: Incorrect identity information, 2FA, or app password.
Meaning: WordPress could not connect to the SMTP host/port.
Possible cause: Firewall, incorrect port, DNS, or service access.
Meaning: The target port is actively rejecting the connection.
Possible cause: Incorrect port or SMTP service closed.
Meaning: Remote server authentication has failed.
Possible cause: Missing or incorrect DNS records or From header mismatch.
Meaning: Recipient address does not exist or has been rejected.
Possible cause: Grammar error, deleted mailbox.
Meaning: The order email event has not been triggered or has been left in the queue.
Possible cause: Action Scheduler, template or SMTP.
No records matching this expression were found.
Commands are for root access. Collect only status and logs first; Do not change the permanent setting without seeing the reason.
wp eval 'var_dump(wp_mail("[email protected]","WordPress test","Test mesajı"));'
The result of the wp_mail function in the application layer is shown.
dig +short TXT example.com
dig +short TXT default._domainkey.example.com
dig +short TXT _dmarc.example.com
Displays SPF, DKIM, and DMARC records.
timeout 10 openssl s_client -starttls smtp -connect smtp.example.com:587 -servername smtp.example.com </dev/null
Tests SMTP connection and TLS handshake from the server.
tail -n 150 /var/log/maillog 2>/dev/null || tail -n 150 /var/log/mail.log 2>/dev/null
Displays local mail delivery and bounce records.
tail -n 150 /var/log/exim_mainlog 2>/dev/null
cPanel/Exim send and queue logs are shown.
wp cron event list --fields=hook,next_run_relative | head -n 40
Checks the cron side of delayed email jobs.
The root cause of the WordPress error is the same, but log paths, PHP settings screens and service management vary depending on the hosting infrastructure used.
Email Deliverability, Track Delivery, and Exim logs are used in cPanel.
grep -i 'ALICI@DOMAIN' /var/log/exim_mainlog | tailMail Settings, Mail Log Browser, and DNS records are checked in Plesk.
grep -i 'ALICI@DOMAIN' /var/log/maillog | tailIn a panel-less server, Postfix/Exim or external SMTP connection is directly inspected.
postqueue -p 2>/dev/null || exim -bp 2>/dev/nullFirst, check if WordPress is producing messages, then SMTP/MTA acceptance and finally remote delivery with DNS verification.
Determine if password reset, form, WooCommerce, or all wp_mail messages are affected.
Send a test email to a single recipient and record the time and From address.
Application returns true even if MTA or SMTP response is not visible.
587 Do not confuse STARTTLS with 465 implicit TLS.
Ensure that from domain authentication is aligned.
Examine spam, bounce, and provider reputation records
Check the form's To/From/Reply-To fields and SMTP log.
admin_email, user address, wp_mail and spam folder are checked.
Scheduled Actions, cron, and order status triggers are checked.
wp cron event listThe application password, 2FA, and user name format are verified.
SPF/DKIM/DMARC, PTR, IP reputation, and Gmail bounce message are examined.
No. It only shows that WordPress successfully sent the message to the mail layer; delivery should be verified with a log.
Provider mostly uses 587 STARTTLS or 465 TLS.
SPF/DMARC configuration and delivery reliability must be compatible with the sender domain.
Should be used in Reply-To field instead of From.
Strongly recommended for delivery reliability and fraud prevention.
Cron, Action Scheduler, order status, or SMTP queue delay may occur.
A correctly configured reliable service usually provides an advantage in terms of delivery and logging.
By analyzing cPanel, WHM, CloudLinux, LiteSpeed, MariaDB, Exim and security layers together, we fix the root cause of the failure instead of just removing the service.