Skip to main content
mySites.guru
NewIntroducing Checklists on mySites.guru: create unlimited task lists with automated and manual stepsSee how it works

Check Your Joomla and WordPress Sites Can Send Email

Check Your Joomla and WordPress Sites Can Send Email

The contact form on a client’s site says the message was sent, and the email never arrives. The client finds out weeks later, usually by asking “Have we had any enquiries?”. Joomla and WordPress do not help much here, because all either one can tell you is that the server accepted the message.

mySites.guru now has Send a Test Email. Tick up to 20 Joomla or WordPress sites and each one sends a real email the way its contact form would, through its own mail settings, and you watch the results arrive: whether the email turned up, whether it passed SPF, DKIM and DMARC, who it was sent from and how long it took. The 47-second film below shows it.

Transcript

Is your client’s website email getting through? Mail stops with no warning. The client tells you, weeks later.

Meet Send a Test Email, in mySites.guru. Tick up to 20 Joomla or WordPress sites, and press Send. Each site sends a real email, the way its contact form would. SPF, DKIM, DMARC, the sender, and how long it took to arrive.

Open a site to see what is weak and what to do about it. Then copy the results for their host in one click.

Know the mail works before your client asks. Send a Test Email. In mySites.guru.

Send a Test Email From Up to 20 Sites at Once

The page lists your connected Joomla and WordPress sites with the columns Site, CMS, Last audit and Can send.

  1. Open it. Find Send a Test Email on the All Tools page, in the One-off section, or through Cmd+K.

    There is also a Send a test email link on the Email Configuration Investigate page, and a Cmd+K site action on a Joomla or WordPress site.

  2. Tick sites. Tick the sites you want to test, or click a row to tick it.

    The Last audit column reads Arrived, or shows a red Not arrived pill where the last audit's test email did not arrive.

  3. Press Send. Press Send in the bulk bar to test up to 20 sites per press.

    Tick more and a toast says "Tick up to 20 sites at a time. You ticked N."

  4. Read the results. With several sites ticked, a results table fills in live as each email arrives, one row per site.

    A row's View opens that site's card and findings, and All results goes back.

The results table has columns for Site, Result, SPF, DKIM, DMARC, Sender and Delivery time. The Result pill moves through Queued, Sending and Waiting (with a running clock), then settles on Passed, Warnings, Failed a check, Could not send, Not reached or Not arrived.

Sites that cannot send are skipped, with a pill in the Can send column saying why. Opted out means the site has the per-site “Skip the email test” setting switched on. SiteGround means SiteGround blocks the test email on that server. Generic sites are not listed at all, because their connector has no test email. Sends go three at a time, because each one waits on that site’s own mail server.

What Each Result Tells You

Open one site and you get its findings table, with the columns Check, Result, What we saw and What to do.

CheckGood resultNeeds workWhat to do
Test emailArrivedNot arrivedCheck your site mail settings, then send a test email or run a new audit.
SPFPassFail, or a warningAdd the server that sends your mail to your domain's SPF record.
DKIMPassFail, or Not signedTurn on DKIM signing with your mail provider.
DMARCPassFail, or a warningPublish a DMARC record for your domain.
SenderOwn domainPersonal mailboxSend from an address on your own domain.
Delivery timeSeconds5 minutes or moreMail is queuing for minutes. Ask your host why.

A warning on SPF, DKIM or DMARC is shown as a word, such as None or Unknown. For an SPF warning the advice changes to “Check your domain’s SPF record is valid and lists the server that sends your mail.” Above the table, the card heading gives the verdict in one line: “The test email arrived and passed every check”, “The test email arrived with warnings” or “The test email arrived but failed a check”.

The Sender check looks at the address the site sends from. A site that sends as a personal mailbox, such as a Gmail or Outlook address, fails SPF for that domain, and it exposes the mailbox if the site is hacked. The advice in full is “Send from an address on your own domain, so a hacked site does not expose a personal mailbox.”

When the Test Email Does Not Arrive

A run can end without an email in four ways, and each points at a different fault.

The first is that the site tried and could not send. Unlike the audit’s test, the connector reports a failure straight back, so an SMTP error shows at once with the site’s own error text. The page says “The site tried to send the message and could not. This is what it reported:”, then the error, then “Fix the mail settings on the site, then send again.” On Joomla, the guide to verifying the email configuration goes through those mail settings one at a time.

The second is Joomla only. If Send Mail is switched off in Global Configuration, the result reads “Send Mail is off in this site’s Global Configuration, so Joomla will not send any email.” with a link to “Open the Send Mail check”.

The third is that the site could not be reached at all. The result is Not reached, with “We could not reach the site, so it never got the request to send.” That result does not blame the mail settings, because the mail settings were never tested.

The fourth is that the site sent the email and nothing arrived. Each run waits 2 minutes, then says “The test email did not arrive within 2 minutes” with the likely cause: “Cloudflare rejects mail that passes neither SPF nor DKIM before it reaches us. Mail servers can also queue a message for a few minutes.” If the last audit saw a personal mailbox as the sender, the page says so too.

The Copy for your host button copies the result as plain text: the site URL, the received time, SPF, DKIM and DMARC with their domains, the sender domain and the delivery time. Paste that into a ticket to the host, and when they say it is fixed, press Send again. Pick other sites goes back to the list.

Why Joomla’s Send Test Mail Button Is Not Enough

Joomla has a Send Test Mail button in Global Configuration, on the Server tab under Mail. It sends one message whose body says “Your email settings are correct!”, and Joomla then tells you the email was sent and to check you received it. There is no arrival check, and no SPF, DKIM or DMARC result.

It also goes to the wrong place for this job. Joomla’s mail template description says the test goes to the sending address, but the code sends it to the logged-in user’s own email address. That is your inbox, not the one your client’s Joomla contact form mails, and the message says the settings are correct whether or not it arrives anywhere. Joomla’s Mailer setting can be PHP Mail (the default), Sendmail or SMTP, and setting Send Mail to No stops all mail from the site.

WordPress core has no SMTP settings and no test button at all. Plugins such as WP Mail SMTP add an Email Test tab. Underneath, wp_mail() uses PHPMailer with PHP’s mail() by default, and its own documentation is plain about what a success means: “A true return value does not automatically mean that the user received the email successfully.”

The PHP manual says the same of mail() itself: “just because the mail was accepted for delivery, it does NOT mean the mail will actually reach the intended destination.” Sent is not arrived. Send a Test Email checks arrival, because the email has to reach mailer-test@mysites.guru before any check can pass.

Gmail, Yahoo and Outlook Turn Away Unauthenticated Mail

The big mailbox providers now require authentication, and they act on it. Gmail’s sender guidelines have required SPF or DKIM from all senders since 1 February 2024, and SPF, DKIM and DMARC from bulk senders, meaning more than 5,000 messages a day to Gmail. Google’s sender FAQ adds: “Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections.”

Yahoo tells all senders to “Implement SPF or DKIM at a minimum”, asks bulk senders for SPF, DKIM and a DMARC policy of at least p=none, and has enforced that since February 2024. Microsoft requires SPF and DKIM to pass, and DMARC of at least p=none, from domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live. Since 5 May 2025 their non-compliant mail goes to Junk.

SPF, DKIM and DMARC in a line each:

  • SPF is the domain saying which servers may send mail for it.
  • DKIM is a cryptographic signature on the message, checked against a public key in the domain’s DNS.
  • DMARC is the owner of the From domain saying what to do with mail that fails, and asking for reports. RFC 9989, published in May 2026, replaces RFC 7489.

A client’s brochure site is nowhere near 5,000 messages a day, but the all-senders rule still applies to it: SPF or DKIM, at a minimum, for Gmail and Yahoo. On shared hosting that is typically where it goes wrong. PHP mail() usually goes out from the web server with no DKIM signature, and that server is often not listed in the domain’s SPF record. A test that only checks “sent” cannot see any of this.

When to Run It

Mail breaks when something around the site changes, so those are the moments to test. Run it:

  • after moving a site to a new host
  • after a DNS or MX change
  • after installing a new SMTP plugin or changing the SMTP password
  • before handing a new site over to a client
  • when a client says enquiries have gone quiet
  • when a host blocks outbound mail

Send a Test Email and the Audit’s Email Test

The two tests use the same address and do different jobs. A mySites.guru audit has its own Email Configuration test, which sends to mailer-test@mysites.guru too. That still runs at the start of every audit. The post on emails from mailer-test@mysites.guru explains that address.

Send a Test Email is the on-demand version, for when you have just changed something and do not want to wait for a full audit. Nothing it finds is written to the site’s audit: the result is kept for ten minutes and shown on the page.

One setting covers both. A site with “Skip the email test” switched on, in its Config on the Advanced tab, shows as Opted out here and is skipped.

Emails from mailer-test@mysites.guruRead the full post

Limits, API and MCP

Every press makes a customer’s server send real mail, and hosts such as SiteGround treat a burst as abuse, so there are limits: 10 test emails an hour per user for each site, and 60 an hour for the whole account. A run is visible only to the user who started it and to the account owner.

The same test is in the API and the MCP server, under the same rules as the page.

JobREST endpointScopeMCP tool
Send a test emailPOST /api/v1/sites/{hashId}/test-emailapi:audits:writesend_test_email
Read the resultGET /api/v1/test-emails/{run}api:audits:readget_test_email_result

Send a Test Email needs a mySites.guru subscription.

Further Reading

Frequently Asked Questions

Does Send a Test Email send anything to my client or their customers?
No. Each site sends one email to mailer-test@mysites.guru, the same address the audit's email test uses. It goes out through the site's own mail settings, the way a contact form or password reset email would, but no customer or client receives it.
Does a test email change the site's audit results?
No. Nothing is written to the site's audit. The result stays on the page and is kept for ten minutes. The audit's own Email Configuration test still runs at the start of every audit.
Why was one of my sites skipped?
The Can send column says why. Opted out means the site has the Skip the email test setting switched on, and SiteGround means SiteGround blocks the test email on that server. Generic sites are not listed at all, because their connector has no test email.
How many test emails can I send?
Up to 20 sites per press of Send. Beyond that the limits are 10 test emails an hour per user for each site, and 60 an hour for the whole account.
What does Personal mailbox mean in the Sender check?
The site is sending from a personal mailbox, not from an address on its own domain. The advice shown is to send from an address on your own domain, so a hacked site does not expose a personal mailbox.
EU icon: AI MODIFIEDWritten and edited by a human, with AI assistance. Our approach to AI

What our users say

Michael Sønderup Nielsen
Michael Sønderup NielsenJoomla Consultant, Joomlakonsulenten
★★★★★

I have been a mySites.guru customer since February 2014, and I now look after more than a hundred Joomla sites through it. Twelve years on, it is still the first place I look whenever something feels off. What makes it work is not just the scanning. It is the judgement built into it. The vulnerable extension alerts do not simply say "update this". They explain what the flaw actually does, whether an attacker needs to log in first, and exactly which version closes it. That is what cracked a case for me recently. The platform pointed out that a critical plugin on a client site was a hidden dependency, installed automatically in the background by another extension. The client had never chosen it and had no idea it was there. Nothing else I use would have told me that. The tools show the same care. Separating "100% certain hacked" from "suspect patterns" is exactly the right distinction, and it stops you frightening a client with a number that turns out to be ordinary software. The "executables only" filter on the core folder check took a list of 250 files down to 13 in a single click. And being able to read a file in the built-in editor before deleting it is a small thing that matters enormously. Then there is Phil. Sharp, quick to respond, and still clearly invested in the details after all these years. That combination is rare. Thank you, Phil. Genuinely.

Read more reviews
Sven Krumbeck
Sven KrumbeckWeb Development, WortBildTon
★★★★★

mySites.guru has become one of the most valuable tools in my WordPress security toolkit. It helped me identify rogue administrator accounts that would otherwise have gone completely unnoticed and provided insights that standard monitoring tools missed. The platform is easy to use, provides actionable information, and gives confidence that potential security problems can be spotted early. For agencies, developers, and website owners who manage WordPress sites, I can highly recommend mySites.guru.

Read more reviews

Read all 306 reviews →

Get an email when the next post is published

Ready to Take Control?

One free audit of one site · no card · about 2 minutes to connect

Get Your Free Site Audit