Module 6 · 6.1

English

Nederlands English Deutsch Français Español Italiano Polski

Your shop's emails and deliverability

Module 6: Management and security · Reading time: 10 minutes

Learning objective: After this lesson you can set up the emails of a WooCommerce shop, make sure they arrive in the inbox and test them, so that no customer is left without a confirmation.

Key concepts: transactional email, order emails for customer and administrator, sender name and sender address, reply address (Reply-To), templates, additional content, SMTP, transactional email service, SPF, DKIM, DMARC, alignment, volume, email off on staging

A shop is also a mail server

An ordinary WordPress site sends the occasional password link or forwards a form. A shop sends email with every order, and those emails are not a side issue. For the customer, the confirmation email is proof that their payment arrived. It is also the durable medium on which you provide the information about the order and the right of withdrawal (lesson 5.4). And the acknowledgement of receipt of a withdrawal (lesson 5.3) really has to reach the customer. If such an email ends up in spam or does not arrive at all, you get questions, duplicate orders and, in the worst case, a customer who thinks you are not delivering.

How email from WordPress works (the wp_mail function, PHP mail, why SMTP is better) is covered in the WordPress course, lesson 9.1. The technology behind SPF, DKIM and DMARC is covered in the Email in order course. This lesson only covers what a shop adds.

Which emails WooCommerce sends

WooCommerce has a fixed set of emails. Under WooCommerce > Settings > Emails (Emails) you can see them all, each with a toggle, the recipient, the subject and the heading. The most important ones:

Email	To	When
New order	Administrator	An order has been paid or put on hold
Processing order	Customer	The payment succeeded; this is the real confirmation
Order on-hold	Customer	You are still waiting for payment, for example a bank transfer
Completed order	Customer	You have set the order to Completed, usually when shipping
Refunded order	Customer	You have refunded (part of) the order
Cancelled order and Failed order	Administrator and customer	The payment failed or the order was cancelled
Customer invoice / Order details	Customer	When you send it manually from the order
Customer note	Customer	When you write a note "to customer" on an order
Reset password, New account	Customer	For accounts

If you use the withdrawal function (lesson 5.3), two more are added: an acknowledgement of receipt for the customer and a notification for you. WooCommerce does not complete a withdrawal if an enabled email cannot be sent. That is another reason email has to work.

Do not switch emails off to get some "peace and quiet". If you want fewer administrator emails, change the recipient to a shared mailbox, not the toggle.

Sender, reply address and content

At the bottom of the email screen you will find the email sender options: the "From" name ("Theehuis Example") and the "From" address. Three rules:

An address on your own domain, for example bestellingen@example.com. Never a Gmail or Outlook.com address: those domains do not allow your server to send email on their behalf, and their DMARC policy lets recipients reject such email.
An address that exists and is read. Customers reply to their confirmation with questions ("can I still add a pack of tea?"). If that reply goes to a noreply address, you lose those questions. If you want replies to go somewhere else, arrange that with a reply address in your mail plugin or with a forwarding rule.
The same domain you send from. If you send via the web server, that server must be in the SPF record of that domain and the email must have a DKIM signature from that domain. That is what the exercise is about.

In each email you can add additional content (a text field below the order details). Use it for what the law requires in the confirmation: a short sentence about the right of withdrawal with a link to your withdrawal information and to the withdrawal button. Put your company details under Customer details and in the footer of the emails. If you want to change more than the per-email settings allow, you can override a template in your (child) theme or use a plugin. Check overridden templates after updates (lesson 6.2).

Why order emails end up in spam

A few causes you often see with shops:

Sending via the web server without SPF and DKIM for the sender domain. The receiving server sees an email "from" example.com coming from an IP that does not belong to it.
Your email is hosted elsewhere. If the mailbox for example.com is with another provider (for example Microsoft 365) and the shop sends via the web server, the SPF record must also allow the web server, or you let the shop send through that provider's mail server using SMTP. KB 13 explains what goes wrong in that case.
Volume and limits. A sale with 600 orders in one evening also means 1,200 emails (customer and administrator). Hosting packages have a limit on the number of emails per hour (KB 20). With many orders or a newsletter, a transactional email service (a service that specialises in email from websites) is a better route; it also gives you an overview of what arrived and what bounced.
Newsletters by the same route. Do not send marketing email from the same address and server as your order emails. A complaint about a newsletter must not drag your order emails down with it. See the Email in order course on newsletters.

For SMTP, use a plugin that lets WordPress send through a real mailbox or service (WordPress course, lesson 9.1), and enter the same sender there as in WooCommerce.

Testing, and keeping staging quiet

After every change, test with a real order in test mode (lesson 4.5), sent to an address with a different provider than your own domain. Do not just check whether it arrived, but also look at the headers of the email: do they show spf=pass, dkim=pass and dmarc=pass with your domain? How to read headers is covered in the Email in order course.

A staging copy (lesson 7.3) contains the real customer data. Switch off sending email there, or send all email to a single test address with a plugin, before you test anything. Otherwise customers receive confirmations of orders that never existed.

At WebOké a site sends via the package's mail server by default; with an SMTP plugin you can send through a mailbox in the same package. Other hosting providers work in a similar way.

In practice: this is what it looks like in WooCommerce

At Theehuis Example:

WooCommerce > Settings > Emails: "From" name "Theehuis Example", "From" address bestellingen@example.com (a real mailbox).
For "New order", the recipient is winkel@example.com, a shared mailbox.
Additional content for "Processing order": "You have a 14-day cooling-off period. You can withdraw via the Withdraw from contract link at the bottom of our site."
An SMTP plugin that sends through the mailbox bestellingen@example.com; SPF, DKIM and DMARC for example.com checked.
Test order to an address with another provider; headers checked.

Summary

Order emails are proof for the customer and the place for the legally required confirmation; they must arrive.
A sender on your own domain, a mailbox that is read, and SPF and DKIM for the server that actually sends.
Watch the limits at busy times; consider a transactional email service and keep newsletters separate.
Test with a test order to an address elsewhere and read the headers.
Switch email off on staging or catch it.

Quiz

Exercise

Exercise A6.1: Do your order emails arrive? Enter your domain, the sender address shown under WooCommerce > Settings > Emails, and the server that actually sends the email: "webserver" if WooCommerce sends via your hosting package, or the hostname of your email service or SMTP server. You may add a DKIM selector (you can find it in the headers of a test email). The program looks up your domain's SPF record and works out whether the IP addresses of that server fit in it (pass), looks for the DKIM record for the selector, and looks up the DMARC record. Green if the sender address ends in your domain, there is exactly one SPF record that gives pass, DKIM is found and there is exactly one valid DMARC record. Orange with softfail or neutral, without a selector, or with DMARC p=none. Red with a sender on a different domain, no SPF record or more than one, fail, a selector without a record, or no DMARC.

Then do this yourself (not checked): place a test order to an address with another provider and find the result of spf, dkim and dmarc in the headers.

A green tick means this check is correct right now, not that your shop is secure.

Cookies at WebOké

Cookie settings

Necessary

Marketing